32100f30681076d7962892a9c1698eeae685eb1a376f0c71cf630f0d39f682a4

General

Target
2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe
Size 64KB
Sample260929-rm2nqssamd
SHA256 32100f30681076d7962892a9c1698eeae685eb1a376f0c71cf630f0d39f682a4
MD5 ebb6750474c5bd609d485aa7b0041f2d
SHA1 0534edd2ab8a2f2f98ffb4e9c99e74450fa47019
SHA512 3c7d3412ff80e8b1db9e17fed9e88ff5104d2cd5fcd44d823c01124116c7dbb6790e07255aed8b7ee64824b09209704a9d795eca9bc9a26d64600ec54fbfc6f8
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNN4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNN4/QQzlhpB
TLSH
T1CF532A436F6A4CF2F3511175086E9F79977B89E4C16EFE9FAB80DD084462681FC39206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 7 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024425-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001dbe8-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0009000000022922-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000400000001dbe8-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000a000000022922-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000e00000002429b-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000b000000022922-26.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 7 IoCs

pid	Process
388	c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe
1220	cBA71766Af9E8724ffd89231f51A776E9EF83z.exe
2016	cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe
4720	c7A10239Ff0308241708B5A6f34E6D931539Ez.exe
620	c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe
624	cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe
3476	c8C5A2709f97A824d3789224fD8CA89CE9A86z.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe	2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe
File created	C:\Windows\cBA71766Af9E8724ffd89231f51A776E9EF83z.exe	c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe
File created	C:\Windows\cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe	cBA71766Af9E8724ffd89231f51A776E9EF83z.exe
File created	C:\Windows\c7A10239Ff0308241708B5A6f34E6D931539Ez.exe	cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe
File created	C:\Windows\c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe	c7A10239Ff0308241708B5A6f34E6D931539Ez.exe
File created	C:\Windows\cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe	c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe
File created	C:\Windows\c8C5A2709f97A824d3789224fD8CA89CE9A86z.exe	cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5096	cmd.exe
4216	cmd.exe
4116	cmd.exe
4048	cmd.exe
1044	cmd.exe
1164	cmd.exe
1724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cBA71766Af9E8724ffd89231f51A776E9EF83z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8C5A2709f97A824d3789224fD8CA89CE9A86z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7A10239Ff0308241708B5A6f34E6D931539Ez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3924	2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	388	c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe
Token: SeIncBasePriorityPrivilege	1220	cBA71766Af9E8724ffd89231f51A776E9EF83z.exe
Token: SeIncBasePriorityPrivilege	2016	cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe
Token: SeIncBasePriorityPrivilege	4720	c7A10239Ff0308241708B5A6f34E6D931539Ez.exe
Token: SeIncBasePriorityPrivilege	620	c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe
Token: SeIncBasePriorityPrivilege	624	cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 388	3924	2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe	99
PID 3924 wrote to memory of 1724	3924	2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe	100
PID 388 wrote to memory of 1220	388	c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe	101
PID 388 wrote to memory of 5096	388	c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe	102
PID 1220 wrote to memory of 2016	1220	cBA71766Af9E8724ffd89231f51A776E9EF83z.exe	106
PID 1220 wrote to memory of 4216	1220	cBA71766Af9E8724ffd89231f51A776E9EF83z.exe	107
PID 2016 wrote to memory of 4720	2016	cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe	108
PID 2016 wrote to memory of 4116	2016	cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe	109
PID 4720 wrote to memory of 620	4720	c7A10239Ff0308241708B5A6f34E6D931539Ez.exe	110
PID 4720 wrote to memory of 4048	4720	c7A10239Ff0308241708B5A6f34E6D931539Ez.exe	111
PID 620 wrote to memory of 624	620	c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe	114
PID 620 wrote to memory of 1044	620	c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe	115
PID 624 wrote to memory of 3476	624	cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe	116
PID 624 wrote to memory of 1164	624	cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-29_ebb6750474c5bd609d485aa7b0041f2d_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe
  C:\Windows\c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\cBA71766Af9E8724ffd89231f51A776E9EF83z.exe
    C:\Windows\cBA71766Af9E8724ffd89231f51A776E9EF83z.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Windows\cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe
      C:\Windows\cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Windows\c7A10239Ff0308241708B5A6f34E6D931539Ez.exe
        
        C:\Windows\c7A10239Ff0308241708B5A6f34E6D931539Ez.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4720
      - C:\Windows\c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe
        
        C:\Windows\c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:620
        
        C:\Windows\cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe
        
        C:\Windows\cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\c8C5A2709f97A824d3789224fD8CA89CE9A86z.exe
        
        C:\Windows\c8C5A2709f97A824d3789224fD8CA89CE9A86z.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\CEAE4C~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C1E37B~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1044
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C7A102~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4048
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\CD7EB3~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4116
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\CBA717~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\C964BB~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe

Path C:\Windows\c1E37B28Df5CA024507880E0f1D8F887FA5ACz.exe
Size 64KB
SHA256 1a655afb17b39af05268a25cf1f3883aaeca3c0d2ad7847daaacfb859cd6dac8
MD5 6971f938723dbecdd73aa0da85ff3a3f
SHA1 c369d2893427c608cbbf754e8f80d99272ef1ce1
SHA512 b41498438588ed388b0a3c2601f1703d70cc8545683b0006cff06ca6c50e56bbb78ca57cd417913e15fce2f740f36866d181e3c460e09f5c24cc1ade74d40ee1
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNV4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNV4/QQzlhpB
TLSH
T116532B436F6A4CF2F3511176086E9F79977B89E4C16EFEDFAB80DD084462681F839206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7A10239Ff0308241708B5A6f34E6D931539Ez.exe

Path C:\Windows\c7A10239Ff0308241708B5A6f34E6D931539Ez.exe
Size 64KB
SHA256 220a692a783358ae4f005aad09fff1bb94446d227656d364cfbe0ed2a3bdf83e
MD5 1b3db71d99ec8cc07d01b7c6cde04373
SHA1 bed40374c51d072ccc34242b7a19f0f4579c98f0
SHA512 6aa177e53a9eb83096c56bf0a6311703b5b38759156dace815ed0dd7b0603b57116a39754a0e2880bb19771a35b03eea2c2b7363c5b3fa7a369c7bd76aec4783
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjN44/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjN44/QQzlhpB
TLSH
T175532A436F6A4CF2F3511175086E9F79976B89E4C16EFEDFAB80DD084462681FC2A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8C5A2709f97A824d3789224fD8CA89CE9A86z.exe

Path C:\Windows\c8C5A2709f97A824d3789224fD8CA89CE9A86z.exe
Size 64KB
SHA256 1c65d8a9f8457530a5e691dbc5271a6494c185972166518b957351b606208160
MD5 7e6f2f7bb387ebc4142277b1662e5d77
SHA1 b1e4c497f57d17150630b58cea796b0e56e9c107
SHA512 48bef0b5e78eb0e74db6a3ea33a422a1f6b9db5f873152719434d70a23f6f1b21b5f5bab3577aae175023db30daab6db38854b9a1088e7896cc94b7303495f5a
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjN54/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjN54/QQzlhpB
TLSH
T12E532A436F6A4CF2F3511176086E9F79977B89E4C16EFE9FAB80DD084462681FC39206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe

Path C:\Windows\c964BB4A8fDD61248cb8B85CfAB4D80720744z.exe
Size 64KB
SHA256 706d40e81720e14cefe69a4000c49dc80aed00809150145831206a7152738e1b
MD5 565d67eb37e1c635f152e87d41a6589f
SHA1 850999b99bf33bd7db95a920601a0310dd05ab04
SHA512 abae31014c57247a8b3a6f8cd9de08eceb638a59710868b39de889604a90af0118da70fe762eb4aca75ed1f374f3281f26b16d9175f4614618180afd2974e8cd
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNw4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNw4/QQzlhpB
TLSH
T1FE532A436F6A4CF2F3511175086E9F79977B89E4C16EFE9FAB80DD084462681F83A206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cBA71766Af9E8724ffd89231f51A776E9EF83z.exe

Path C:\Windows\cBA71766Af9E8724ffd89231f51A776E9EF83z.exe
Size 64KB
SHA256 3ef7f6128348cffdace23250c4e8cac96ae36c3c9f51070417b23bcb32cbc248
MD5 b41a280c5deb15d273e3eb4b6593237d
SHA1 2748211f38add1f7179d0ef0b2f2bd3f59fb6913
SHA512 0a884f43f77b6996ab2a4a7281bdd4ce37089c911122499fdfa3f4408ba06b6cda0c6d301149ef231ef0d58b4320e66a7653099070c4dc112d2ff2903418e5d7
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNl4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNl4/QQzlhpB
TLSH
T15D532B436FAA4CF2F3511175086E9F79977B89E4C16EFE9FAB80DD084462681FC39206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe

Path C:\Windows\cD7EB39B0f891E24bbb8BE2Af371E5D8DA0C5z.exe
Size 64KB
SHA256 c85890ce958f64b346e9c23ddd7fa9d72a09c43cf363326095c51a9149d69046
MD5 2b790f0539ea349e864977d981621805
SHA1 6a1798132c84eccd5308bae56ccacfe197e257de
SHA512 c5448d4c2ad3835bb6ff7f729471a1ddcf9aacf5e9b2d7ae254cef3958af1d1292fb46705f2418100f4f8f089ab857c1e62cd6e5eb8d9b81bd9d3d90a52c1371
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNI4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNI4/QQzlhpB
TLSH
T18D532A436F6A4CF2F3511175086E9F79976B89E4C16EFE9FAB80DD084462681F829206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe

Path C:\Windows\cEAE4C91Ff6B98246be885ACf62C1587E0C30z.exe
Size 64KB
SHA256 983344b307ea7fcaed67cb1229928d470b06161890d517fbe8b2fad4c69753ed
MD5 fc5ffff7d2bbb974e03dda6e32d4916b
SHA1 ec39caf289c5cbf7d437a4ddf3bab897f6cda37f
SHA512 f4b6e0aa79c538fb3995f716ee7e51c081534be7e5ad4968a80f37afe76c6fc7a27906802a89ae12e23ef0454d366632efacd66eb2a8c66fe5c7329bbbb2a1c7
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNd4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNd4/QQzlhpB
TLSH
T13F532A436FAA4CF2F3511175086E9F79977B89E4C16EFEDFAB80DD084462681F839206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads