7f7d5a411358095664ff8b3f412c0d4169a8b80902cd6e8844379b7047838cc8

General

Target
2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe
Size 59KB
Sample260812-ecafaavvbz
SHA256 7f7d5a411358095664ff8b3f412c0d4169a8b80902cd6e8844379b7047838cc8
MD5 191a8f4867de18e13371fdf9c0ee2b5b
SHA1 d1feb567ef3fee1f1008a722eeb90ed2bf389f6c
SHA512 67c9d47c80f861edaa29fbeb7b95a8a1259d5a71f5ed508e81188721e0393de4b9a096564ebf9c77542974a3647af9985389701bed64f647bcea6883e0a6d2b3
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroSh1k4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroYk4/QQ2fBOu
TLSH
T10F433A430FDD5CF2FB810175087E8B7986BB59E4C25FBEDBAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000243a7-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000a0000000243b4-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024488-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 3 IoCs

pid	Process
4088	m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe
1672	mE0032085m3613r487cxBA54z8CA8051E6EC99.exe
4656	mE0F98A9Dm9170r4471x8CECz45E5104A97C29.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\mE0032085m3613r487cxBA54z8CA8051E6EC99.exe	m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe
File created	C:\Windows\mE0F98A9Dm9170r4471x8CECz45E5104A97C29.exe	mE0032085m3613r487cxBA54z8CA8051E6EC99.exe
File created	C:\Windows\m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe	2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
724	cmd.exe
3528	cmd.exe
5028	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mE0032085m3613r487cxBA54z8CA8051E6EC99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mE0F98A9Dm9170r4471x8CECz45E5104A97C29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2756	2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	4088	m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe
Token: SeIncBasePriorityPrivilege	1672	mE0032085m3613r487cxBA54z8CA8051E6EC99.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 4088	2756	2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe	86
PID 2756 wrote to memory of 724	2756	2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe	87
PID 4088 wrote to memory of 1672	4088	m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe	88
PID 4088 wrote to memory of 3528	4088	m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe	89
PID 1672 wrote to memory of 4656	1672	mE0032085m3613r487cxBA54z8CA8051E6EC99.exe	96
PID 1672 wrote to memory of 5028	1672	mE0032085m3613r487cxBA54z8CA8051E6EC99.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_191a8f4867de18e13371fdf9c0ee2b5b_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe
  C:\Windows\m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\mE0032085m3613r487cxBA54z8CA8051E6EC99.exe
    C:\Windows\mE0032085m3613r487cxBA54z8CA8051E6EC99.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Windows\mE0F98A9Dm9170r4471x8CECz45E5104A97C29.exe
      C:\Windows\mE0F98A9Dm9170r4471x8CECz45E5104A97C29.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4656
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\ME0032~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\M9D0C5~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe

Path C:\Windows\m9D0C5489m5B3Cr4571xAE36z9E8DD08CC73A9.exe
Size 59KB
SHA256 bfe0134a39346e8c445d30d384d399cf5757a900da807e15053f71ace182d29b
MD5 52caef027bc0d5880b356f0688b32cba
SHA1 7eb0906ae85fc2c93d6b6243ae4b1061c1281509
SHA512 d9b9d68a785fa3ac1d3f24abd4739bcefce1cce97b3005bcde5a9ad6be80856acfa1644aa787367001f913cc868dcf0dc303d18fe4e6d31c12ae12df43d5bf4e
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLros4/Clsrnu5WcnfBYRu:Mvw9816vhKQLros4/QQ2fBOu
TLSH
T19D433A430FDD5CF2FB810175087E8B7986BB59E4C25FBEDBAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mE0032085m3613r487cxBA54z8CA8051E6EC99.exe

Path C:\Windows\mE0032085m3613r487cxBA54z8CA8051E6EC99.exe
Size 59KB
SHA256 487646b0035cb6c58cf0b470dc074f97c2da72afd32831034c043b6da87cbfd7
MD5 953758488a81832b1748bab67d4c7401
SHA1 bb75784d6bbff0f1336e5bf39fc651eb07574d4e
SHA512 5fab3b676750865bcab30a2533893d62deaa1ec18a86dc1e6912811e70e910a424cc6e9188108fe6980463a136c4e50027263183fe0c10c6c6c1a37d3aa0aa99
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroW4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroW4/QQ2fBOu
TLSH
T1904339430FDD5CF2FB810175087E8B7986BB59E4C25FBE9BAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mE0F98A9Dm9170r4471x8CECz45E5104A97C29.exe

Path C:\Windows\mE0F98A9Dm9170r4471x8CECz45E5104A97C29.exe
Size 59KB
SHA256 6ec24bd3772075cc0a6746178638de1f970d592180ed719902a0fc6ab7fe8f81
MD5 3c682d4f896610d5680983b0ac93b375
SHA1 11780704afac81bcb9860c03c047843687800e20
SHA512 124f0b1ef7b776db33d34b885a3c001198a0357af692deb3e44243c933cf8124b4368c2a042465a0ba73c58969b3b6fc281b16d1b930bccdf4ef52204328c67d
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroO4/Clsrnu5WcnfBYRu:Mvw9816vhKQLroO4/QQ2fBOu
TLSH
T17D433A431FDD5CF2FB810175087E8B7986BB59E4C25FFE9BAB50CC184836691E83A50A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads