50d14d0741fb0ef8eab8f74ec596eb40b71c5099b874bb1825a85a8b7a1f47f8

General

Target
2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe
Size 64KB
Sample261023-spms2as16j
SHA256 50d14d0741fb0ef8eab8f74ec596eb40b71c5099b874bb1825a85a8b7a1f47f8
MD5 0b3dace816b66ada9da345d7ee0335ac
SHA1 57987c7e33f90f68d86bda1d8f6dfea4a183159d
SHA512 81c8cb10e28dabb57a959e3d96e8d4be3dc15ed80660ee228687a04743a27bbf0c42ee43b44b225aa137ab993216d2582578a67af8d7bb7643cd6ed2828998a5
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNT4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNT4/QQzlhpB
TLSH
T189532A436F6A4CF2F3511176086E9F79977B89E4C16EFEDFAB80DD084462681F839206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 6 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243a4-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024394-5.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00080000000243ad-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00030000000006d5-15.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0004000000000703-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00040000000006d5-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 6 IoCs

pid	Process
3036	c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe
512	c0B9B304FfD7C924a9788868f70C24A82D656z.exe
2568	c8A28A322f6E7D243ab8A337fA3BC74961763z.exe
432	c0EB3BB10f1F282405589EBEf33974ACD4173z.exe
4440	c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe
3164	cC53BD658f414B24e798870DfEE0A64ECC16Dz.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe	2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe
File created	C:\Windows\c0B9B304FfD7C924a9788868f70C24A82D656z.exe	c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe
File created	C:\Windows\c8A28A322f6E7D243ab8A337fA3BC74961763z.exe	c0B9B304FfD7C924a9788868f70C24A82D656z.exe
File created	C:\Windows\c0EB3BB10f1F282405589EBEf33974ACD4173z.exe	c8A28A322f6E7D243ab8A337fA3BC74961763z.exe
File created	C:\Windows\c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe	c0EB3BB10f1F282405589EBEf33974ACD4173z.exe
File created	C:\Windows\cC53BD658f414B24e798870DfEE0A64ECC16Dz.exe	c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4724	cmd.exe
3328	cmd.exe
1504	cmd.exe
3304	cmd.exe
3176	cmd.exe
1372	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8A28A322f6E7D243ab8A337fA3BC74961763z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0EB3BB10f1F282405589EBEf33974ACD4173z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cC53BD658f414B24e798870DfEE0A64ECC16Dz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c0B9B304FfD7C924a9788868f70C24A82D656z.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4296	2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	3036	c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe
Token: SeIncBasePriorityPrivilege	512	c0B9B304FfD7C924a9788868f70C24A82D656z.exe
Token: SeIncBasePriorityPrivilege	2568	c8A28A322f6E7D243ab8A337fA3BC74961763z.exe
Token: SeIncBasePriorityPrivilege	432	c0EB3BB10f1F282405589EBEf33974ACD4173z.exe
Token: SeIncBasePriorityPrivilege	4440	c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 3036	4296	2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe	90
PID 4296 wrote to memory of 1372	4296	2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe	91
PID 3036 wrote to memory of 512	3036	c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe	92
PID 3036 wrote to memory of 4724	3036	c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe	93
PID 512 wrote to memory of 2568	512	c0B9B304FfD7C924a9788868f70C24A82D656z.exe	96
PID 512 wrote to memory of 3328	512	c0B9B304FfD7C924a9788868f70C24A82D656z.exe	97
PID 2568 wrote to memory of 432	2568	c8A28A322f6E7D243ab8A337fA3BC74961763z.exe	98
PID 2568 wrote to memory of 1504	2568	c8A28A322f6E7D243ab8A337fA3BC74961763z.exe	99
PID 432 wrote to memory of 4440	432	c0EB3BB10f1F282405589EBEf33974ACD4173z.exe	100
PID 432 wrote to memory of 3304	432	c0EB3BB10f1F282405589EBEf33974ACD4173z.exe	101
PID 4440 wrote to memory of 3164	4440	c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe	102
PID 4440 wrote to memory of 3176	4440	c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_0b3dace816b66ada9da345d7ee0335ac_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe
  C:\Windows\c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\c0B9B304FfD7C924a9788868f70C24A82D656z.exe
    C:\Windows\c0B9B304FfD7C924a9788868f70C24A82D656z.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:512
  - - C:\Windows\c8A28A322f6E7D243ab8A337fA3BC74961763z.exe
      C:\Windows\c8A28A322f6E7D243ab8A337fA3BC74961763z.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\c0EB3BB10f1F282405589EBEf33974ACD4173z.exe
        
        C:\Windows\c0EB3BB10f1F282405589EBEf33974ACD4173z.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:432
      - C:\Windows\c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe
        
        C:\Windows\c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\cC53BD658f414B24e798870DfEE0A64ECC16Dz.exe
        
        C:\Windows\cC53BD658f414B24e798870DfEE0A64ECC16Dz.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C26650~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3176
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C0EB3B~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3304
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C8A28A~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1504
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\C0B9B3~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\C0BEA0~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c0B9B304FfD7C924a9788868f70C24A82D656z.exe

Path C:\Windows\c0B9B304FfD7C924a9788868f70C24A82D656z.exe
Size 64KB
SHA256 8d4557955fca7245099bea10c4997138c08b739e9eaffd41f571fb235a413280
MD5 0d12b1df31b5597082859716ffde4238
SHA1 67ef511bbc2fba08649e90793e038ba85fce8d07
SHA512 68778e1da2a88e84bbc025a80f5eb5048d3a3124bd5e7563a32a346473de8bdc728073ab2bece3d4c2cc2f31a3369df0dfc3bc0db604689400db7440297397c5
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjN74/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjN74/QQzlhpB
TLSH
T124532A436F6A4CF2F3511175086EDF79976B89E4C16EFEDFAB80DD084462681F839206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe

Path C:\Windows\c0BEA0728fFDAC24e0c8A300fA7669AA2FC7Fz.exe
Size 64KB
SHA256 6fe2b9ff274b1904e9f04b87bad72716e99f1c8df2256bd51bd2668bbb3deb3e
MD5 69b645878769413fa296282c71cad8ad
SHA1 c0662d7c7486641ff5a7541285347fc32a5e0e0b
SHA512 90e25b628813a5ec9364bfb269b0acda811b033c764958584ae7bdd6ef6e960c5c617a94b31ccd438443bab7ad4bc02b9386b80bfa2d63521c385a693ca30c00
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNL4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNL4/QQzlhpB
TLSH
T1FD533B436F6A4CF2F3511175086E9F79977B89E4C16EFEDFAB80DD084462681F839206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c0EB3BB10f1F282405589EBEf33974ACD4173z.exe

Path C:\Windows\c0EB3BB10f1F282405589EBEf33974ACD4173z.exe
Size 64KB
SHA256 eb95b7fc2fc9dc03fec10fd6889a28cb63d14939d8c2f9ba82f8a0cf05675cf3
MD5 736b55e232825291835e8e88f3790b2b
SHA1 56b4003d262c233155394df4726c206fbbad0013
SHA512 4105a35591bf3b406b36956af8170ad17797caae25d90fcbfc99b42448f249ab3a7efb1cf8d49f614ab31b48f72005b4f9fdbbaf0ca36d629b0b305c9a192b4a
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjN14/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjN14/QQzlhpB
TLSH
T11E532A436F6A4CF2F3511175086E9F79977B89E4C16EFEDFAB80DD084462681FC29206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe

Path C:\Windows\c26650886fFBBF247a989F67f4AA4F1C7C39Dz.exe
Size 64KB
SHA256 94efc401a85ab1f9724b747b970f0293d79cb3e8dc72914d38cf4a858697e91f
MD5 88b48784c8e67ec7f5e2f847ddb8be72
SHA1 a6ac9dcdf5e14f39534414e09e5affe952bf0a29
SHA512 4493d3dc12d6c7ba773519639153df63f0b980f1437e433dd47ad2e113f7b79697fe3b6bbf28bc62551800b48e4a19493db2c46678371ba8e24ffe20661506fb
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNx4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNx4/QQzlhpB
TLSH
T112532A436F6A4CF2F3511175086E9F79977B89E4C16EFEDFAB80DD084462681FC29206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8A28A322f6E7D243ab8A337fA3BC74961763z.exe

Path C:\Windows\c8A28A322f6E7D243ab8A337fA3BC74961763z.exe
Size 64KB
SHA256 75ea99dd84186010141b9fe9ff2aba43ff05a6711d42fcf3a65c8418c348a7c1
MD5 2603035601c17223ea06228b76f2e136
SHA1 38dcd5d59962e29ac68293727b4c1d915fb1787e
SHA512 7d0f83aafa541772f69cb3d920e9dc96c51018f6b2ca1c09544962c7b1c39bf4c9dce7b3d63521588d946b21af3feaa5ddbe3506b9eb4a9d9dfc8ca9aa1cbed3
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNu4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNu4/QQzlhpB
TLSH
T1FA532A436FAA4CF2F3511175086E9F79977B89E4C16EFEDFAB80DD084462681F839206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cC53BD658f414B24e798870DfEE0A64ECC16Dz.exe

Path C:\Windows\cC53BD658f414B24e798870DfEE0A64ECC16Dz.exe
Size 64KB
SHA256 b803cc5bbd059ad5c80b9aa6382a8e63e5208910af5fd4925fed7d2bf452656e
MD5 66a7b06273a78c0dcf7fab922e6af851
SHA1 68ad337e6dcb31a72246eaa705ee15954c80de6d
SHA512 479736a632c7764be4186bc339d6abbf1ff213ec8c20deadf41096cd6de32e37c13d5382856491279be7a45ac26dd34c44e865561a7ca91840ff0f92ef9770bd
SSDEEP 384:CjibD2liXsafEHsc4gsFW6e/hHjNL4/ClsrQjlslE6uWB:Cjif24cafxisFW7/hHjNL4/QQzlhpB
TLSH
T112532A436F6A4CF2F3511176086E9F79976B89E4C16EFE9FAB80DD084462681FC29206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads