Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 09:50
General
- Target 2026-10-23_8e568cc5862b2887f907561b6d5b5978_elex_remcos_wannacry.exe
- Size 60KB
- Sample261023-lvdc8a1x3j
- SHA256 ed7408cebf7f1ade9e94e4b55093d366e682e8a1aa7446c474b4a4cdea1de166
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_8e568cc5862b2887f907561b6d5b5978_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_8e568cc5862b2887f907561b6d5b5978_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7695FD4-D5C2-4b17-895D-2641E6F103DE}.exeC:\Windows\{C7695FD4-D5C2-4b17-895D-2641E6F103DE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{412EFB78-4E50-42ac-8039-A0099CF6007A}.exeC:\Windows\{412EFB78-4E50-42ac-8039-A0099CF6007A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{14B5E5F4-1120-47d6-9431-F0A1D49A8C86}.exeC:\Windows\{14B5E5F4-1120-47d6-9431-F0A1D49A8C86}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6DD97B1C-9207-41fd-AC4A-B4D115D8DE41}.exeC:\Windows\{6DD97B1C-9207-41fd-AC4A-B4D115D8DE41}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C71EDBE-BCCA-4265-AA3A-5E9B3C2B7308}.exeC:\Windows\{3C71EDBE-BCCA-4265-AA3A-5E9B3C2B7308}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E086B858-046D-44cf-A92D-68C4EB0DE7B2}.exeC:\Windows\{E086B858-046D-44cf-A92D-68C4EB0DE7B2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7C5C5D5-437C-41cf-BF3B-E6D61F19DB10}.exeC:\Windows\{C7C5C5D5-437C-41cf-BF3B-E6D61F19DB10}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FDA6C712-0509-43ab-8279-CE9C9D573676}.exeC:\Windows\{FDA6C712-0509-43ab-8279-CE9C9D573676}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FED45C0A-5DC5-4857-9C30-16FE3FD5D0DD}.exeC:\Windows\{FED45C0A-5DC5-4857-9C30-16FE3FD5D0DD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21953AB1-ACCD-4103-AB09-96D5962DB048}.exeC:\Windows\{21953AB1-ACCD-4103-AB09-96D5962DB048}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56A0AE27-824C-4bbb-8D7B-D2EA005DDDB2}.exeC:\Windows\{56A0AE27-824C-4bbb-8D7B-D2EA005DDDB2}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21953~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FED45~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDA6C~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7C5C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E086B~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C71E~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6DD97~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{14B5E~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{412EF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7695~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{14B5E5F4-1120-47d6-9431-F0A1D49A8C86}.exe
{21953AB1-ACCD-4103-AB09-96D5962DB048}.exe
{3C71EDBE-BCCA-4265-AA3A-5E9B3C2B7308}.exe
{412EFB78-4E50-42ac-8039-A0099CF6007A}.exe
{56A0AE27-824C-4bbb-8D7B-D2EA005DDDB2}.exe
{6DD97B1C-9207-41fd-AC4A-B4D115D8DE41}.exe
{C7695FD4-D5C2-4b17-895D-2641E6F103DE}.exe
{C7C5C5D5-437C-41cf-BF3B-E6D61F19DB10}.exe
{E086B858-046D-44cf-A92D-68C4EB0DE7B2}.exe
{FDA6C712-0509-43ab-8279-CE9C9D573676}.exe
{FED45C0A-5DC5-4857-9C30-16FE3FD5D0DD}.exe