Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 03:48
General
- Target 2026-08-12_12508145286d2fb5cd55280a10e4cb4f_elex_remcos_wannacry.exe
- Size 79KB
- Sample260812-ecvffshr9t
- SHA256 aad060ab2a2c31beff65c30e03802f3e579a5a9cc2eab2a09b52d7816b170a78
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_12508145286d2fb5cd55280a10e4cb4f_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_12508145286d2fb5cd55280a10e4cb4f_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3C653EF-191B-434f-B372-8AC9F15F4EFF}.exeC:\Windows\{C3C653EF-191B-434f-B372-8AC9F15F4EFF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2751E1E1-F5C5-4c93-AAF5-7E00CD309ACB}.exeC:\Windows\{2751E1E1-F5C5-4c93-AAF5-7E00CD309ACB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{270E36A4-DC9E-4921-85D6-450D802B4B11}.exeC:\Windows\{270E36A4-DC9E-4921-85D6-450D802B4B11}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8D57191C-38A4-4e6b-BFE9-7709FD6BD98C}.exeC:\Windows\{8D57191C-38A4-4e6b-BFE9-7709FD6BD98C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0BDB0E1-1D42-4f85-AA34-20D7FFCCB1D7}.exeC:\Windows\{F0BDB0E1-1D42-4f85-AA34-20D7FFCCB1D7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{748054E1-E6A7-49b5-B83C-466F884D3AD0}.exeC:\Windows\{748054E1-E6A7-49b5-B83C-466F884D3AD0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A42F31C3-3D59-445f-A8E8-482E32840763}.exeC:\Windows\{A42F31C3-3D59-445f-A8E8-482E32840763}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6765944A-DE3C-48c3-9606-A7270B6A9A7D}.exeC:\Windows\{6765944A-DE3C-48c3-9606-A7270B6A9A7D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1453B937-9645-4ceb-9C53-88E57BF5C6C9}.exeC:\Windows\{1453B937-9645-4ceb-9C53-88E57BF5C6C9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24FEF82A-6564-4ba0-B4BD-4E11379CF518}.exeC:\Windows\{24FEF82A-6564-4ba0-B4BD-4E11379CF518}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{117B82E6-EDDF-45e3-A4D1-6CF05B5AA67C}.exeC:\Windows\{117B82E6-EDDF-45e3-A4D1-6CF05B5AA67C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24FEF~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1453B~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67659~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A42F3~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74805~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0BDB~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8D571~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{270E3~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2751E~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3C65~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{117B82E6-EDDF-45e3-A4D1-6CF05B5AA67C}.exe
{1453B937-9645-4ceb-9C53-88E57BF5C6C9}.exe
{24FEF82A-6564-4ba0-B4BD-4E11379CF518}.exe
{270E36A4-DC9E-4921-85D6-450D802B4B11}.exe
{2751E1E1-F5C5-4c93-AAF5-7E00CD309ACB}.exe
{6765944A-DE3C-48c3-9606-A7270B6A9A7D}.exe
{748054E1-E6A7-49b5-B83C-466F884D3AD0}.exe
{8D57191C-38A4-4e6b-BFE9-7709FD6BD98C}.exe
{A42F31C3-3D59-445f-A8E8-482E32840763}.exe
{C3C653EF-191B-434f-B372-8AC9F15F4EFF}.exe
{F0BDB0E1-1D42-4f85-AA34-20D7FFCCB1D7}.exe