9570b715eac9f89984ab34fe0349f27c0a14057cc96085ea6435566534a52c16

General

Target
2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe
Size 84KB
Sample260814-srfshaw1c1
SHA256 9570b715eac9f89984ab34fe0349f27c0a14057cc96085ea6435566534a52c16
MD5 fac5622871a87298bff5ca0b445d97c3
SHA1 3e9dabbc05f097035f8cdb65478de59132381cf9
SHA512 aee3fd9f9ddff3aa1a3f99c95fd84cdc4230b84b5d70ed66f24a19e4b670f65b989cb5b98943148cdd559593feb387c63f5ead7491ed5a2dbc1be1594f969bcc
SSDEEP 768:rvw9816vhKQLroxo4/QQF7PQcpFpZOgDaLSQTTyS1tl7lfqvocqcdxZV9:7EGh0oxoFM7PQcpMgDaLfnyS1loLDL
TLSH
T101836C03A684B5F2EB6C0135B19F0F7E963786B1C4C9682F5B638DB95862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e6a4-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001e6ec-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 2 IoCs

pid	Process
1768	mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe
1948	m9D7EFFDAc04C6a41d619FB1n0BAA45E09329u.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe	2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe
File created	C:\Windows\m9D7EFFDAc04C6a41d619FB1n0BAA45E09329u.exe	mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2616	cmd.exe
2368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	m9D7EFFDAc04C6a41d619FB1n0BAA45E09329u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4240	2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	1768	mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 1768	4240	2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe	87
PID 4240 wrote to memory of 2616	4240	2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe	88
PID 1768 wrote to memory of 1948	1768	mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe	89
PID 1768 wrote to memory of 2368	1768	mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_fac5622871a87298bff5ca0b445d97c3_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe
  C:\Windows\mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\m9D7EFFDAc04C6a41d619FB1n0BAA45E09329u.exe
    C:\Windows\m9D7EFFDAc04C6a41d619FB1n0BAA45E09329u.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\MA4CE8~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

m9D7EFFDAc04C6a41d619FB1n0BAA45E09329u.exe

Path C:\Windows\m9D7EFFDAc04C6a41d619FB1n0BAA45E09329u.exe
Size 84KB
SHA256 0f1fa3e4f8569f38adc214fab1001943fea76686191a9db0e3de5d954e6a9bc0
MD5 61805aa08088aa9c7d986ba9825547da
SHA1 313d4204190fa0b2fa539d5e9b6cdf19349818e6
SHA512 e51c4a5453cac6074d252ed1e63f6bc05a6184a58f04ead518abbbd7f48632ce574ee1b6a4995974ab1de8537c8009af7e126b7267899c73bc3bc19e59cd01c3
SSDEEP 768:rvw9816vhKQLroao4/QQF7PQcpFpZOgDaLSQTTyS1tl7lfqvocqcdxZV9:7EGh0oaoFM7PQcpMgDaLfnyS1loLDL
TLSH
T1D3836C03A684B5F2EB6C0135B19F0F7E963786B1C4C9682F5B638DB95862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe

Path C:\Windows\mA4CE8570c3B30a45e71AF58nA4D2842AE108u.exe
Size 84KB
SHA256 291aafe0bdf05c49eae8bfa90be102a783a77ded8eba4873cc9eefcaec2522d7
MD5 edcd161dad889e623b1a7fc7bd3dad7a
SHA1 dc6116689a2ac72d248098616409ba35c302e761
SHA512 454e32cc3239d43b5ec53cb2775815c38c2d56556667237b142ee808e1f882b3a2cb2707f23aa9bdfb51f8ebc99480bb842e6fba47c146a10d6b9410672d8247
SSDEEP 768:rvw9816vhKQLroTo4/QQF7PQcpFpZOgDaLSQTTyS1tl7lfqvocqcdxZV9:7EGh0oToFM7PQcpMgDaLfnyS1loLDL
TLSH
T1DC836C03A584B5F2EB6C0135B19F0F7E963786B1C4C9682F5B638DB55862863F431E17
MD5 SHA1 SHA512 SSDEEP TLSH