Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/10/2026, 15:14
General
- Target 2026-10-23_0cdbb50a71980e573afac7b04a44db43_elex_remcos_wannacry.exe
- Size 64KB
- Sample261023-smpjvact21
- SHA256 8ea5a782e43ede1a0355638f24e490a2de62da7599fb0897f1a7f858d3607a45
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-23_0cdbb50a71980e573afac7b04a44db43_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-23_0cdbb50a71980e573afac7b04a44db43_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E38B7A0-ABF0-4d93-888B-8F74B17A5FCF}.exeC:\Windows\{7E38B7A0-ABF0-4d93-888B-8F74B17A5FCF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5DCBD74-860E-4fac-9069-778FD586378A}.exeC:\Windows\{B5DCBD74-860E-4fac-9069-778FD586378A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34C93275-F154-4f0e-85AE-C0C5E69B0EA7}.exeC:\Windows\{34C93275-F154-4f0e-85AE-C0C5E69B0EA7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{68474305-6F6C-4b3f-A501-11668F31A07B}.exeC:\Windows\{68474305-6F6C-4b3f-A501-11668F31A07B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0834A0EE-FB72-491c-8358-D5167DAFD880}.exeC:\Windows\{0834A0EE-FB72-491c-8358-D5167DAFD880}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BCBB328C-8E95-4ad7-8B4F-AE5F231EF3B1}.exeC:\Windows\{BCBB328C-8E95-4ad7-8B4F-AE5F231EF3B1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{169A65B7-0D7E-4b53-B9E4-D505FF9A3CFD}.exeC:\Windows\{169A65B7-0D7E-4b53-B9E4-D505FF9A3CFD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9E86803-D6E5-4d90-AE15-5A00DF29847B}.exeC:\Windows\{F9E86803-D6E5-4d90-AE15-5A00DF29847B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B46DAD68-2D3F-4fff-A774-A63FE557742C}.exeC:\Windows\{B46DAD68-2D3F-4fff-A774-A63FE557742C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3044A9B3-D0E0-4783-9FFD-0F4451988ED3}.exeC:\Windows\{3044A9B3-D0E0-4783-9FFD-0F4451988ED3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{445F101D-A9CB-4b72-A04D-CAC8C44205BE}.exeC:\Windows\{445F101D-A9CB-4b72-A04D-CAC8C44205BE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3044A~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B46DA~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9E86~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{169A6~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BCBB3~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0834A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{68474~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34C93~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5DCB~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E38B~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0834A0EE-FB72-491c-8358-D5167DAFD880}.exe
{169A65B7-0D7E-4b53-B9E4-D505FF9A3CFD}.exe
{3044A9B3-D0E0-4783-9FFD-0F4451988ED3}.exe
{34C93275-F154-4f0e-85AE-C0C5E69B0EA7}.exe
{445F101D-A9CB-4b72-A04D-CAC8C44205BE}.exe
{68474305-6F6C-4b3f-A501-11668F31A07B}.exe
{7E38B7A0-ABF0-4d93-888B-8F74B17A5FCF}.exe
{B46DAD68-2D3F-4fff-A774-A63FE557742C}.exe
{B5DCBD74-860E-4fac-9069-778FD586378A}.exe
{BCBB328C-8E95-4ad7-8B4F-AE5F231EF3B1}.exe
{F9E86803-D6E5-4d90-AE15-5A00DF29847B}.exe
memory/772-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/772-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1192-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1192-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1900-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1900-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2416-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2416-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2636-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2636-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3908-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3908-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4068-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4796-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4796-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5076-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5076-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5156-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5156-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5156-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5248-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5248-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5980-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5980-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5980-14-0x0000000000400000-0x0000000000410000-memory.dmp