Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 09:27
General
- Target 2026-08-20_e75668a315cbfe00dae4d85faadc5b79_elex_remcos_wannacry.exe
- Size 60KB
- Sample260820-le3yyatdmf
- SHA256 7432421f721d2369c5db798eb12f8844204105820b034208642800d6663949f3
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_e75668a315cbfe00dae4d85faadc5b79_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_e75668a315cbfe00dae4d85faadc5b79_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84C2AEB4-06BF-4b3e-8B42-EAFFDA857194}.exeC:\Windows\{84C2AEB4-06BF-4b3e-8B42-EAFFDA857194}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DDCCECCA-8AB5-411a-B200-F2C5ABC0FADD}.exeC:\Windows\{DDCCECCA-8AB5-411a-B200-F2C5ABC0FADD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D66D3E2C-0400-4fe4-B347-53E4A9CB3244}.exeC:\Windows\{D66D3E2C-0400-4fe4-B347-53E4A9CB3244}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B21778D4-2751-41ab-9A5A-AED1A43008F0}.exeC:\Windows\{B21778D4-2751-41ab-9A5A-AED1A43008F0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8EFA1B3-A47B-4040-96C6-71013E313D08}.exeC:\Windows\{C8EFA1B3-A47B-4040-96C6-71013E313D08}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E02338C-090E-435a-BFCC-91654D7198C5}.exeC:\Windows\{9E02338C-090E-435a-BFCC-91654D7198C5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1996392-4139-457b-A68C-E10D2C4D8DF8}.exeC:\Windows\{F1996392-4139-457b-A68C-E10D2C4D8DF8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1C2F2DF-666F-4a1b-AC97-6FDCF200A93B}.exeC:\Windows\{D1C2F2DF-666F-4a1b-AC97-6FDCF200A93B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73664CE4-C360-407f-8FF0-A651E84B5010}.exeC:\Windows\{73664CE4-C360-407f-8FF0-A651E84B5010}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F667544-561B-4763-8AA9-78D25ED88A63}.exeC:\Windows\{7F667544-561B-4763-8AA9-78D25ED88A63}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{992D32E1-1DD9-41d0-8EFE-61CD88CB08E1}.exeC:\Windows\{992D32E1-1DD9-41d0-8EFE-61CD88CB08E1}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F667~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73664~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1C2F~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1996~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E023~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8EFA~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2177~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D66D3~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDCCE~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84C2A~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{73664CE4-C360-407f-8FF0-A651E84B5010}.exe
{7F667544-561B-4763-8AA9-78D25ED88A63}.exe
{84C2AEB4-06BF-4b3e-8B42-EAFFDA857194}.exe
{992D32E1-1DD9-41d0-8EFE-61CD88CB08E1}.exe
{9E02338C-090E-435a-BFCC-91654D7198C5}.exe
{B21778D4-2751-41ab-9A5A-AED1A43008F0}.exe
{C8EFA1B3-A47B-4040-96C6-71013E313D08}.exe
{D1C2F2DF-666F-4a1b-AC97-6FDCF200A93B}.exe
{D66D3E2C-0400-4fe4-B347-53E4A9CB3244}.exe
{DDCCECCA-8AB5-411a-B200-F2C5ABC0FADD}.exe
{F1996392-4139-457b-A68C-E10D2C4D8DF8}.exe
memory/248-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/248-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1004-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1824-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1824-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1824-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2088-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2088-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2112-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2112-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2112-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2296-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2296-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2944-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2944-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3672-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3672-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4100-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4100-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4120-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4120-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4636-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4636-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5196-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5196-43-0x0000000000400000-0x0000000000410000-memory.dmp