Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/10/2026, 20:26
General
- Target 2026-10-14_617e5007c5e742548bfd8dcb969fdaa0_elex_remcos_wannacry.exe
- Size 64KB
- Sample261014-y72msshv3k
- SHA256 a3f8131377c2d93dfccedbbf425c1227452e23beab5ebc9e25e5e589dc29f69e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Detects Windows executables referencing non-Windows User-Agents 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-14_617e5007c5e742548bfd8dcb969fdaa0_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-14_617e5007c5e742548bfd8dcb969fdaa0_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42E7584B-D34B-44b9-A301-B20E646FE22A}.exeC:\Windows\{42E7584B-D34B-44b9-A301-B20E646FE22A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3C0C647-3501-4496-9F50-DBD173C69148}.exeC:\Windows\{F3C0C647-3501-4496-9F50-DBD173C69148}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02B0BCB0-D4F0-4876-B03A-914B285D44F4}.exeC:\Windows\{02B0BCB0-D4F0-4876-B03A-914B285D44F4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{015096DC-7644-4397-A74A-62159E7D13A1}.exeC:\Windows\{015096DC-7644-4397-A74A-62159E7D13A1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{27C02891-DEB7-4f7a-8E95-73C5A7101E90}.exeC:\Windows\{27C02891-DEB7-4f7a-8E95-73C5A7101E90}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{470DC16C-DF4F-45b7-83C1-163DE09C1BAB}.exeC:\Windows\{470DC16C-DF4F-45b7-83C1-163DE09C1BAB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C02886B-03C6-4632-94A1-9010EF7919E2}.exeC:\Windows\{2C02886B-03C6-4632-94A1-9010EF7919E2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9ECAAC05-21E9-48ed-9F47-9DE05CB742F2}.exeC:\Windows\{9ECAAC05-21E9-48ed-9F47-9DE05CB742F2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8FA1F36-8FAA-4c07-A755-151DA2C127BA}.exeC:\Windows\{B8FA1F36-8FAA-4c07-A755-151DA2C127BA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E482D634-6EE7-4baf-B30D-0BD95431E53D}.exeC:\Windows\{E482D634-6EE7-4baf-B30D-0BD95431E53D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{796F9ED3-8D49-4d25-97ED-34CA0CD97BC8}.exeC:\Windows\{796F9ED3-8D49-4d25-97ED-34CA0CD97BC8}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E482D~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8FA1~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9ECAA~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C028~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{470DC~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27C02~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01509~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02B0B~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3C0C~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42E75~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{015096DC-7644-4397-A74A-62159E7D13A1}.exe
{02B0BCB0-D4F0-4876-B03A-914B285D44F4}.exe
{27C02891-DEB7-4f7a-8E95-73C5A7101E90}.exe
{2C02886B-03C6-4632-94A1-9010EF7919E2}.exe
{42E7584B-D34B-44b9-A301-B20E646FE22A}.exe
{470DC16C-DF4F-45b7-83C1-163DE09C1BAB}.exe
{796F9ED3-8D49-4d25-97ED-34CA0CD97BC8}.exe
{9ECAAC05-21E9-48ed-9F47-9DE05CB742F2}.exe
{B8FA1F36-8FAA-4c07-A755-151DA2C127BA}.exe
{E482D634-6EE7-4baf-B30D-0BD95431E53D}.exe
{F3C0C647-3501-4496-9F50-DBD173C69148}.exe
memory/740-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/740-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/964-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/964-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/988-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/988-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1648-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1648-59-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1804-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1804-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2272-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2496-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3892-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3892-39-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4016-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4016-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4240-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4520-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4520-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4520-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4968-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4968-5-0x0000000000400000-0x0000000000410000-memory.dmp