Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 16:36
General
- Target 2026-08-18_e3cca36c515b6e142897f8b92fac29e4_elex_remcos_wannacry.exe
- Size 60KB
- Sample260818-t384vsxvaz
- SHA256 0372c3979ecbfe8fc9bf1eae8b0a7354297e3ad9ec779ecc4ac631f175588d4a
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_e3cca36c515b6e142897f8b92fac29e4_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_e3cca36c515b6e142897f8b92fac29e4_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A5035E1-1DF6-43b4-9E5E-04026167A7EA}.exeC:\Windows\{4A5035E1-1DF6-43b4-9E5E-04026167A7EA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4649E76-AF44-431f-92BF-0D9DB60429E6}.exeC:\Windows\{C4649E76-AF44-431f-92BF-0D9DB60429E6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7203FF0B-9DB1-4bed-AECA-D929ADFE81E8}.exeC:\Windows\{7203FF0B-9DB1-4bed-AECA-D929ADFE81E8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8883B802-1F5B-4056-A205-B2562E92DE76}.exeC:\Windows\{8883B802-1F5B-4056-A205-B2562E92DE76}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27A25716-F86F-4243-A493-F56F21BF59E8}.exeC:\Windows\{27A25716-F86F-4243-A493-F56F21BF59E8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20CF5EE1-A877-4282-AB01-147CCCEF6DFF}.exeC:\Windows\{20CF5EE1-A877-4282-AB01-147CCCEF6DFF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3028EF7C-E9EB-4858-BF95-CCAC3C0FD2CE}.exeC:\Windows\{3028EF7C-E9EB-4858-BF95-CCAC3C0FD2CE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A0FC47C-9D6D-4bd4-9D32-DB7F80DC4C2F}.exeC:\Windows\{7A0FC47C-9D6D-4bd4-9D32-DB7F80DC4C2F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F006475B-6F77-4c2f-86A8-6A2B19EB9181}.exeC:\Windows\{F006475B-6F77-4c2f-86A8-6A2B19EB9181}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05C029FA-B4E3-4dd6-94A9-491050FA8881}.exeC:\Windows\{05C029FA-B4E3-4dd6-94A9-491050FA8881}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B61AD4D-28C4-4cbd-916F-F41461E4BB84}.exeC:\Windows\{0B61AD4D-28C4-4cbd-916F-F41461E4BB84}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05C02~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0064~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A0FC~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3028E~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20CF5~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27A25~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8883B~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7203F~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4649~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A503~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{05C029FA-B4E3-4dd6-94A9-491050FA8881}.exe
{0B61AD4D-28C4-4cbd-916F-F41461E4BB84}.exe
{20CF5EE1-A877-4282-AB01-147CCCEF6DFF}.exe
{27A25716-F86F-4243-A493-F56F21BF59E8}.exe
{3028EF7C-E9EB-4858-BF95-CCAC3C0FD2CE}.exe
{4A5035E1-1DF6-43b4-9E5E-04026167A7EA}.exe
{7203FF0B-9DB1-4bed-AECA-D929ADFE81E8}.exe
{7A0FC47C-9D6D-4bd4-9D32-DB7F80DC4C2F}.exe
{8883B802-1F5B-4056-A205-B2562E92DE76}.exe
{C4649E76-AF44-431f-92BF-0D9DB60429E6}.exe
{F006475B-6F77-4c2f-86A8-6A2B19EB9181}.exe