Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 03:45
General
- Target 2026-08-19_f8f92ef4ad1c53c4fb8621c7e12f7fb2_elex_remcos_wannacry.exe
- Size 64KB
- Sample260819-ea23hsxydw
- SHA256 e9a3a8da231949c5ae684086183126d2186203164bf4ebf8570dacb3f00bce0f
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_f8f92ef4ad1c53c4fb8621c7e12f7fb2_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_f8f92ef4ad1c53c4fb8621c7e12f7fb2_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86E03172-707E-4f58-A94E-DA94B13C77B5}.exeC:\Windows\{86E03172-707E-4f58-A94E-DA94B13C77B5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0DC0618-43F0-40c4-905E-15FDF0771876}.exeC:\Windows\{A0DC0618-43F0-40c4-905E-15FDF0771876}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4AE342B-4773-49c7-B5E5-304DA2B2B240}.exeC:\Windows\{F4AE342B-4773-49c7-B5E5-304DA2B2B240}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6CE0AB2A-FCDC-4e76-9A5F-5D00995A8091}.exeC:\Windows\{6CE0AB2A-FCDC-4e76-9A5F-5D00995A8091}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F04E781-B06C-47e8-BFDE-689E7AE40E0E}.exeC:\Windows\{9F04E781-B06C-47e8-BFDE-689E7AE40E0E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF9547F5-9153-4be5-91FF-0BC93B83D15D}.exeC:\Windows\{EF9547F5-9153-4be5-91FF-0BC93B83D15D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82B82718-66FC-4e39-A943-D51CB70F18AD}.exeC:\Windows\{82B82718-66FC-4e39-A943-D51CB70F18AD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1F1D840-3D9E-4bc4-A473-4EF07C789409}.exeC:\Windows\{D1F1D840-3D9E-4bc4-A473-4EF07C789409}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC803332-8028-4f9b-A468-ABF3FAEBE5D2}.exeC:\Windows\{BC803332-8028-4f9b-A468-ABF3FAEBE5D2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3AB1C14-9E7B-42fe-94F3-AA1F1AFF91A4}.exeC:\Windows\{C3AB1C14-9E7B-42fe-94F3-AA1F1AFF91A4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{853C351E-EFDA-496a-9D63-5730DB34B04D}.exeC:\Windows\{853C351E-EFDA-496a-9D63-5730DB34B04D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3AB1~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC803~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1F1D~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82B82~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF954~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F04E~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6CE0A~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4AE3~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0DC0~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86E03~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{6CE0AB2A-FCDC-4e76-9A5F-5D00995A8091}.exe
{82B82718-66FC-4e39-A943-D51CB70F18AD}.exe
{853C351E-EFDA-496a-9D63-5730DB34B04D}.exe
{86E03172-707E-4f58-A94E-DA94B13C77B5}.exe
{9F04E781-B06C-47e8-BFDE-689E7AE40E0E}.exe
{A0DC0618-43F0-40c4-905E-15FDF0771876}.exe
{BC803332-8028-4f9b-A468-ABF3FAEBE5D2}.exe
{C3AB1C14-9E7B-42fe-94F3-AA1F1AFF91A4}.exe
{D1F1D840-3D9E-4bc4-A473-4EF07C789409}.exe
{EF9547F5-9153-4be5-91FF-0BC93B83D15D}.exe
{F4AE342B-4773-49c7-B5E5-304DA2B2B240}.exe
memory/732-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/732-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1012-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1012-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3928-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3928-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4088-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4088-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4212-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4212-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4828-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4828-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4828-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5124-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5124-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5296-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5296-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5296-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5564-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5564-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5772-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5772-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5928-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6020-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6020-76-0x0000000000400000-0x0000000000410000-memory.dmp