Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
15/10/2026, 22:24
General
- Target 2026-10-15_f8f957b065871d9272b5e7e46035d2ea_elex_remcos_wannacry.exe
- Size 60KB
- Sample261015-2be1pset3j
- SHA256 d6eae351d86b013b86c772b228edff24f0930c0b96c636d159bc6ee3df78aa72
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_f8f957b065871d9272b5e7e46035d2ea_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f8f957b065871d9272b5e7e46035d2ea_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1428543-6DF4-43f2-9D0A-93BC65629867}.exeC:\Windows\{D1428543-6DF4-43f2-9D0A-93BC65629867}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61A43F52-7513-4a98-890A-6B601D74B903}.exeC:\Windows\{61A43F52-7513-4a98-890A-6B601D74B903}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AA21709-325D-494f-8D61-1EFCCD86F9BE}.exeC:\Windows\{7AA21709-325D-494f-8D61-1EFCCD86F9BE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A619613-E1EF-47da-B411-719EA8355C9F}.exeC:\Windows\{0A619613-E1EF-47da-B411-719EA8355C9F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48DDE1AB-22D9-44e5-BBDB-9570E704A685}.exeC:\Windows\{48DDE1AB-22D9-44e5-BBDB-9570E704A685}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0894DDF3-7170-459c-B833-A8D89A4328CF}.exeC:\Windows\{0894DDF3-7170-459c-B833-A8D89A4328CF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C36BBC1-7A8E-4582-86D6-BE159DAA651D}.exeC:\Windows\{6C36BBC1-7A8E-4582-86D6-BE159DAA651D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3EE78D3-4BE8-4c38-AA17-C55B88B9A75C}.exeC:\Windows\{E3EE78D3-4BE8-4c38-AA17-C55B88B9A75C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE70A501-5C6A-479d-B940-BC06A86BD09D}.exeC:\Windows\{EE70A501-5C6A-479d-B940-BC06A86BD09D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBEE4AFA-1D39-488a-9382-7E0677942848}.exeC:\Windows\{DBEE4AFA-1D39-488a-9382-7E0677942848}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7CCB91BD-9498-46c5-9526-589B448F7DCE}.exeC:\Windows\{7CCB91BD-9498-46c5-9526-589B448F7DCE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBEE4~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE70A~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3EE7~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C36B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0894D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48DDE~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A619~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AA21~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61A43~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1428~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0894DDF3-7170-459c-B833-A8D89A4328CF}.exe
{0A619613-E1EF-47da-B411-719EA8355C9F}.exe
{48DDE1AB-22D9-44e5-BBDB-9570E704A685}.exe
{61A43F52-7513-4a98-890A-6B601D74B903}.exe
{6C36BBC1-7A8E-4582-86D6-BE159DAA651D}.exe
{7AA21709-325D-494f-8D61-1EFCCD86F9BE}.exe
{7CCB91BD-9498-46c5-9526-589B448F7DCE}.exe
{D1428543-6DF4-43f2-9D0A-93BC65629867}.exe
{DBEE4AFA-1D39-488a-9382-7E0677942848}.exe
{E3EE78D3-4BE8-4c38-AA17-C55B88B9A75C}.exe
{EE70A501-5C6A-479d-B940-BC06A86BD09D}.exe
memory/1320-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1320-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2136-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2136-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3232-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3232-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3764-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3764-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3880-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3880-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3936-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3936-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4196-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4196-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4196-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4572-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4572-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4572-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4632-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4632-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4748-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4748-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5024-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5380-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5380-35-0x0000000000400000-0x0000000000410000-memory.dmp