8cd07c9cdac8364e936be4fac0f4c17e41e4f72a41f0666a8cac6a5ab6d0061f

General

Target
2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe
Size 64KB
Sample260819-116paaxtft
SHA256 8cd07c9cdac8364e936be4fac0f4c17e41e4f72a41f0666a8cac6a5ab6d0061f
MD5 bedd12238e016fb24ed621075ea73a97
SHA1 5476f65b6fc51b223a24c7ff273b38070968657c
SHA512 c6da267bb6bef1b5f517dc032f003ed7fa0e147b86e01c92bbdb5a7bbce492c9863ff558fb07b6ff367c94536520ded447b3f249e4db28478a363c583007fbff
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNp4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNp4/QQzlhpB
TLSH
T141532A436F6A4CF2F3511176086E9F79972B89E4C16EFEDFAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 6 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024680-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024681-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000800000002468a-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000500000001e44f-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024697-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000600000001e44f-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 6 IoCs

pid	Process
3976	cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe
3996	c30EA3A40f64D724b2288D1Ef386663CD9571z.exe
5332	c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe
1132	c2EB16A15f394624a4489A8Bf141209990E70z.exe
5948	c683765F9f40CA249298B4D6fF3032627380Ez.exe
892	cF614F799f88B024cf789C41fE35AA041651Az.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\cF614F799f88B024cf789C41fE35AA041651Az.exe	c683765F9f40CA249298B4D6fF3032627380Ez.exe
File created	C:\Windows\cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe	2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe
File created	C:\Windows\c30EA3A40f64D724b2288D1Ef386663CD9571z.exe	cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe
File created	C:\Windows\c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe	c30EA3A40f64D724b2288D1Ef386663CD9571z.exe
File created	C:\Windows\c2EB16A15f394624a4489A8Bf141209990E70z.exe	c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe
File created	C:\Windows\c683765F9f40CA249298B4D6fF3032627380Ez.exe	c2EB16A15f394624a4489A8Bf141209990E70z.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4336	cmd.exe
5044	cmd.exe
3468	cmd.exe
6016	cmd.exe
3828	cmd.exe
2344	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cF614F799f88B024cf789C41fE35AA041651Az.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c2EB16A15f394624a4489A8Bf141209990E70z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c683765F9f40CA249298B4D6fF3032627380Ez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c30EA3A40f64D724b2288D1Ef386663CD9571z.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4976	2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	3976	cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe
Token: SeIncBasePriorityPrivilege	3996	c30EA3A40f64D724b2288D1Ef386663CD9571z.exe
Token: SeIncBasePriorityPrivilege	5332	c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe
Token: SeIncBasePriorityPrivilege	1132	c2EB16A15f394624a4489A8Bf141209990E70z.exe
Token: SeIncBasePriorityPrivilege	5948	c683765F9f40CA249298B4D6fF3032627380Ez.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3976	4976	2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe	86
PID 4976 wrote to memory of 2344	4976	2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe	87
PID 3976 wrote to memory of 3996	3976	cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe	88
PID 3976 wrote to memory of 4336	3976	cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe	89
PID 3996 wrote to memory of 5332	3996	c30EA3A40f64D724b2288D1Ef386663CD9571z.exe	93
PID 3996 wrote to memory of 5044	3996	c30EA3A40f64D724b2288D1Ef386663CD9571z.exe	94
PID 5332 wrote to memory of 1132	5332	c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe	95
PID 5332 wrote to memory of 3468	5332	c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe	96
PID 1132 wrote to memory of 5948	1132	c2EB16A15f394624a4489A8Bf141209990E70z.exe	104
PID 1132 wrote to memory of 6016	1132	c2EB16A15f394624a4489A8Bf141209990E70z.exe	105
PID 5948 wrote to memory of 892	5948	c683765F9f40CA249298B4D6fF3032627380Ez.exe	106
PID 5948 wrote to memory of 3828	5948	c683765F9f40CA249298B4D6fF3032627380Ez.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bedd12238e016fb24ed621075ea73a97_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe
  C:\Windows\cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Windows\c30EA3A40f64D724b2288D1Ef386663CD9571z.exe
    C:\Windows\c30EA3A40f64D724b2288D1Ef386663CD9571z.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe
      C:\Windows\c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5332
    - - C:\Windows\c2EB16A15f394624a4489A8Bf141209990E70z.exe
        
        C:\Windows\c2EB16A15f394624a4489A8Bf141209990E70z.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1132
      - C:\Windows\c683765F9f40CA249298B4D6fF3032627380Ez.exe
        
        C:\Windows\c683765F9f40CA249298B4D6fF3032627380Ez.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5948
        
        C:\Windows\cF614F799f88B024cf789C41fE35AA041651Az.exe
        
        C:\Windows\cF614F799f88B024cf789C41fE35AA041651Az.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:892
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C68376~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3828
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C2EB16~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6016
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C18153~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3468
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\C30EA3~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\CDC809~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe

Path C:\Windows\c18153AC7fF3F124cb9887B6f06A1D74274D1z.exe
Size 64KB
SHA256 39440b5b0abcaf890df53efb78523ba8bb1820aef14faabce882fa2a0f684e92
MD5 10669d4381aecf0656673a5712e26901
SHA1 f6541594c6acc2f6dc6e977618c4485c59b3208c
SHA512 5cb0d32943f48a1dff40fb94ae013c94a07dbf0dcf64be96b524bbf3f0a2ae7e8e42786146b4532d7a5691b1bd3ee155a8565efddbac2c77efcfb695ae7805cf
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjN+4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjN+4/QQzlhpB
TLSH
T14A532B436F694CF2F3511175086E9F79973B89E4C16EFE9FAB80DD084462681FC39606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2EB16A15f394624a4489A8Bf141209990E70z.exe

Path C:\Windows\c2EB16A15f394624a4489A8Bf141209990E70z.exe
Size 64KB
SHA256 e8c078bbf032c5c379fe5f949a469115150158523efa28f3d0b10cf724c93fce
MD5 f4ea121dd10adbb13b21634c892b9d38
SHA1 d73b91dff1516d30c5f6b9a53a8842e04f907118
SHA512 3e7bcc7dabdf5d0c82dec898a79981c1f443838f99f12b78e16ae42296b15bc9ffe699f72086a9cbc726458980ab269d1ffb87746d43dcfbc8c659283412572c
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjN84/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjN84/QQzlhpB
TLSH
T1F7532A436F6A4CF2F3511175086E9E79972B89E4C16EFEDFAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c30EA3A40f64D724b2288D1Ef386663CD9571z.exe

Path C:\Windows\c30EA3A40f64D724b2288D1Ef386663CD9571z.exe
Size 64KB
SHA256 1470b235f640c313317522a5b39d30a1802feeb933e71c1ec11bf88f4841d108
MD5 3fd790c491ebb58d8985cfc52aa8e559
SHA1 58b26c296d715601fdca204ae23f0085dd2a14e7
SHA512 4834764eabb5259aa59e10d4dfe808e92ea375eb2ae91e276bb340e8e8f4d2b99000b9de54677fd9b2b2d873391f6b807b32eaa3a4d738580c20ad51a3e2f0a2
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNA4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNA4/QQzlhpB
TLSH
T129532B436F694CF2F3511175086E9F79972B89E4C16EFEDFAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c683765F9f40CA249298B4D6fF3032627380Ez.exe

Path C:\Windows\c683765F9f40CA249298B4D6fF3032627380Ez.exe
Size 64KB
SHA256 5147ef85595f0410ce138cf606f2ebd8c46d8779b6bd19ef8d0a7a71318e6ce4
MD5 d0e2d220ba7b174ed2686bd93a85ccbd
SHA1 fce97b499431613d6a239abd4135ef0a957bacc8
SHA512 3e87ae34f6e5807cce471c75329c1c33b72e9a59f1e71a5d439c46bfb2a5649855dded95edce2ac5a2f36ad15903147852a5140f8cb4e1480fd423caa6301a32
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNG4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNG4/QQzlhpB
TLSH
T175533B436F6A4CF2F3511175086E9F79972B89E4C16EFEDFAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe

Path C:\Windows\cDC809EE2fA6F3249ae8908AfAE31C987BCC3z.exe
Size 64KB
SHA256 a2732e4d88d6f71e031263bd29229173f070e03ed9e28a345180b7106162dee6
MD5 368c4b9ab87cf94e5ec14549df1d8130
SHA1 b38b87c3722078418eef144673d8216ba482ad56
SHA512 7ea3feb5dce423c22e689868198b0da38174ad7b2c2d90c97e8ac53e30e9f344aed2df6cad2dce505a31b1ddae5714059d7bd6db6648a9279d81bb8d69edc9b5
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNk4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNk4/QQzlhpB
TLSH
T15F532A436F694CF2F3511175086E9E79973B89E4C16EFE9FAB80DD084462681F839206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cF614F799f88B024cf789C41fE35AA041651Az.exe

Path C:\Windows\cF614F799f88B024cf789C41fE35AA041651Az.exe
Size 64KB
SHA256 3566e10a48a03b8c31e115674d83d0a34e26507c84daa0f8e467064229e74780
MD5 ff64b87b13ea3f3ecaa622a3a1fc3961
SHA1 65aaa20625b5716e397666b24ae8d7da1c0fea36
SHA512 d84deaacaec1f9f4c5ebd734e4ca47c2a695ab45c587520b453d54b478f181b031267c5f90f11fb4f0bc5ac47323a5d7186e84623779e51cb7d36aaed7de723e
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNl4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNl4/QQzlhpB
TLSH
T17D533B436F6A4CF2F3511176086E9F79973B89E4C16EFEDFAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads