Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 22:20
General
- Target 2026-10-15_f98cbf4a88400312830de8e411a27a09_elex_remcos_wannacry.exe
- Size 59KB
- Sample261015-19b62aee67
- SHA256 ffc49b123102a79df824ab1f43f3b3d8a3cfa55e3a3d8fbcd83fe41efec086a4
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_f98cbf4a88400312830de8e411a27a09_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f98cbf4a88400312830de8e411a27a09_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89EC686A-3B2B-44fa-9A40-3C2AE61F0581}.exeC:\Windows\{89EC686A-3B2B-44fa-9A40-3C2AE61F0581}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4222A972-4499-47b3-A2EC-B3CED4B33777}.exeC:\Windows\{4222A972-4499-47b3-A2EC-B3CED4B33777}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B60CDF91-D68B-4940-9492-AAD8BF9B9570}.exeC:\Windows\{B60CDF91-D68B-4940-9492-AAD8BF9B9570}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEA403EB-3214-4d49-933C-058AAC33DEC9}.exeC:\Windows\{DEA403EB-3214-4d49-933C-058AAC33DEC9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07C799B4-7610-4ccf-9D4F-E872527702EE}.exeC:\Windows\{07C799B4-7610-4ccf-9D4F-E872527702EE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74324DEA-6EBE-4a88-8CAA-DA70438E70E6}.exeC:\Windows\{74324DEA-6EBE-4a88-8CAA-DA70438E70E6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6D851C5-FD52-4d0a-9660-5146668088BD}.exeC:\Windows\{B6D851C5-FD52-4d0a-9660-5146668088BD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{132182A2-AF01-4e1b-B8D8-02832554CF6A}.exeC:\Windows\{132182A2-AF01-4e1b-B8D8-02832554CF6A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4607647C-269A-4158-82C3-F3E0B3F129AE}.exeC:\Windows\{4607647C-269A-4158-82C3-F3E0B3F129AE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C15A085B-4F20-4079-958E-F4DA86F58CEC}.exeC:\Windows\{C15A085B-4F20-4079-958E-F4DA86F58CEC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37114AD9-74CD-49a9-AA05-1B6890427959}.exeC:\Windows\{37114AD9-74CD-49a9-AA05-1B6890427959}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C15A0~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46076~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{13218~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6D85~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74324~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07C79~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEA40~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B60CD~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4222A~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89EC6~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{07C799B4-7610-4ccf-9D4F-E872527702EE}.exe
{132182A2-AF01-4e1b-B8D8-02832554CF6A}.exe
{37114AD9-74CD-49a9-AA05-1B6890427959}.exe
{4222A972-4499-47b3-A2EC-B3CED4B33777}.exe
{4607647C-269A-4158-82C3-F3E0B3F129AE}.exe
{74324DEA-6EBE-4a88-8CAA-DA70438E70E6}.exe
{89EC686A-3B2B-44fa-9A40-3C2AE61F0581}.exe
{B60CDF91-D68B-4940-9492-AAD8BF9B9570}.exe
{B6D851C5-FD52-4d0a-9660-5146668088BD}.exe
{C15A085B-4F20-4079-958E-F4DA86F58CEC}.exe
{DEA403EB-3214-4d49-933C-058AAC33DEC9}.exe