Analysis
- max time kernel
148s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/08/2026, 12:17
General
- Target 2026-08-15_81268b9fcc7cf7981b0f097a67b3a4a1_elex_remcos_wannacry.exe
- Size 64KB
- Sample260815-pgjvmaff64
- SHA256 53ef21c9c6a40d34a561da60ce28deb4126c4d1d5e1a161bf16b411cfd02bdd8
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_81268b9fcc7cf7981b0f097a67b3a4a1_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_81268b9fcc7cf7981b0f097a67b3a4a1_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10879CBB-799E-472d-B094-265958C2918C}.exeC:\Windows\{10879CBB-799E-472d-B094-265958C2918C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D6C0232-8814-49ef-BC94-E891EB380B38}.exeC:\Windows\{1D6C0232-8814-49ef-BC94-E891EB380B38}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81D8CB0F-DFFC-4aff-A459-2700064B4AB4}.exeC:\Windows\{81D8CB0F-DFFC-4aff-A459-2700064B4AB4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{234730DA-6B02-4aec-98BF-C3D26919B21E}.exeC:\Windows\{234730DA-6B02-4aec-98BF-C3D26919B21E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EBC5720-A1AA-4553-A597-7EE89E1124BD}.exeC:\Windows\{9EBC5720-A1AA-4553-A597-7EE89E1124BD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D96A9B84-D59A-47ec-92AF-38C3C6A079E5}.exeC:\Windows\{D96A9B84-D59A-47ec-92AF-38C3C6A079E5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64D98A91-BD6C-4a32-9FAF-5761F2A02212}.exeC:\Windows\{64D98A91-BD6C-4a32-9FAF-5761F2A02212}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{102933CE-6D5F-46b0-ADC7-BFEC5531849F}.exeC:\Windows\{102933CE-6D5F-46b0-ADC7-BFEC5531849F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3DF4587-053E-44ae-9670-5DD6418A88A5}.exeC:\Windows\{E3DF4587-053E-44ae-9670-5DD6418A88A5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF8E4C45-1457-4020-A794-3F8B91BFDD75}.exeC:\Windows\{EF8E4C45-1457-4020-A794-3F8B91BFDD75}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECC57A10-B975-4dd7-85D6-700ADE335628}.exeC:\Windows\{ECC57A10-B975-4dd7-85D6-700ADE335628}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF8E4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3DF4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10293~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64D98~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D96A9~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EBC5~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23473~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81D8C~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D6C0~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10879~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{102933CE-6D5F-46b0-ADC7-BFEC5531849F}.exe
{10879CBB-799E-472d-B094-265958C2918C}.exe
{1D6C0232-8814-49ef-BC94-E891EB380B38}.exe
{234730DA-6B02-4aec-98BF-C3D26919B21E}.exe
{64D98A91-BD6C-4a32-9FAF-5761F2A02212}.exe
{81D8CB0F-DFFC-4aff-A459-2700064B4AB4}.exe
{9EBC5720-A1AA-4553-A597-7EE89E1124BD}.exe
{D96A9B84-D59A-47ec-92AF-38C3C6A079E5}.exe
{E3DF4587-053E-44ae-9670-5DD6418A88A5}.exe
{ECC57A10-B975-4dd7-85D6-700ADE335628}.exe
{EF8E4C45-1457-4020-A794-3F8B91BFDD75}.exe
memory/864-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/864-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/940-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/940-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1820-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1820-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2000-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2000-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2388-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2388-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3284-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3284-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3328-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3328-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3328-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3768-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3768-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4896-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4896-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5020-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5832-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5832-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5940-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5940-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5940-70-0x0000000000400000-0x0000000000410000-memory.dmp