c53a6ae0b2b4f5910f454242b470ceb012a72bcb3dc5b160b4a36442859ed083

General

Target
2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe
Size 64KB
Sample261024-dcdx2aeb27
SHA256 c53a6ae0b2b4f5910f454242b470ceb012a72bcb3dc5b160b4a36442859ed083
MD5 9e73e852df6ec2bfe54cfc20a3270845
SHA1 89ffd4f98028ea387f95c65a5304905b669542bd
SHA512 edf08bd5387a197996b84e42eabdfad928298e39bc9b539c2590ca39e5414797bb36b4000fc6b4e9c47e778df707517adc3454b081ed99eaa5fd42dd21cf8a09
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNU4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNU4/QQzlhpB
TLSH
T103533B436F6A4CF2F3511176086E9F79972B89E4C16EFEDFAB80DD084462681FC39606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral1/files/0x000f000000024388-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024379-5.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 2 IoCs

pid	Process
4440	c257239ADfF05324e148B951f0FBD8CC6156Fz.exe
700	cFECB1E20f00822434f8996Af1CC1C49CD2A9z.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\c257239ADfF05324e148B951f0FBD8CC6156Fz.exe	2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe
File created	C:\Windows\cFECB1E20f00822434f8996Af1CC1C49CD2A9z.exe	c257239ADfF05324e148B951f0FBD8CC6156Fz.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
4236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c257239ADfF05324e148B951f0FBD8CC6156Fz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cFECB1E20f00822434f8996Af1CC1C49CD2A9z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3140	2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	4440	c257239ADfF05324e148B951f0FBD8CC6156Fz.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4440	3140	2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe	92
PID 3140 wrote to memory of 4120	3140	2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe	93
PID 4440 wrote to memory of 700	4440	c257239ADfF05324e148B951f0FBD8CC6156Fz.exe	94
PID 4440 wrote to memory of 4236	4440	c257239ADfF05324e148B951f0FBD8CC6156Fz.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9e73e852df6ec2bfe54cfc20a3270845_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\c257239ADfF05324e148B951f0FBD8CC6156Fz.exe
  C:\Windows\c257239ADfF05324e148B951f0FBD8CC6156Fz.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\cFECB1E20f00822434f8996Af1CC1C49CD2A9z.exe
    C:\Windows\cFECB1E20f00822434f8996Af1CC1C49CD2A9z.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\C25723~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c257239ADfF05324e148B951f0FBD8CC6156Fz.exe

Path C:\Windows\c257239ADfF05324e148B951f0FBD8CC6156Fz.exe
Size 64KB
SHA256 5df78070bdc82c9a64504fee879ebc988a2d0a274aa50100af7c28ebe0758763
MD5 89ba923b4f666be3a3578892607558e3
SHA1 62c10b2fd96d2f2f888a326535e13b825707e3d3
SHA512 fe04c24d4a8c156d93b36f1829713fe82171f813c42f0cd78034d668ac42d8b9e2830cf67b514259dea5ca519529580bc8bf486ef066586d52ed0c80240123c9
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjN14/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjN14/QQzlhpB
TLSH
T192532A436F6A4CF2F3511175086E9F79973B89E4C16EFEDFAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cFECB1E20f00822434f8996Af1CC1C49CD2A9z.exe

Path C:\Windows\cFECB1E20f00822434f8996Af1CC1C49CD2A9z.exe
Size 64KB
SHA256 ef9dd387a552b0e0ec1f2106da390a2ea2ab9065c2453eba3ea1a3acbf274dad
MD5 dc0f086355c8c79e6d4965a3056feda7
SHA1 80afa14bca8d38b341473c0ed781537fc20ef772
SHA512 1629d7e2c231e99b4af5479ff769cb59143098fc257eafe2672863da6d6e08101c82443035a55d5f7d373eddc555d859c7db894216aa3e5407533d7c7ed84a17
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNK4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNK4/QQzlhpB
TLSH
T141532B436F694CF2F3511176086E9F79973B89E4C1AEFE9FAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH