Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 08:42
General
- Target 2026-10-22_73be892c6a264a81edef6a8dcc1d7fee_elex_remcos_wannacry.exe
- Size 64KB
- Sample261024-kmfb6stscy
- SHA256 787efdc2e43587b5bb33c0e99e44a0e67a1ade323fbd3bd8ef444239f96fb0aa
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 35 IoCs
- Detects Windows executables referencing non-Windows User-Agents 35 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_73be892c6a264a81edef6a8dcc1d7fee_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_73be892c6a264a81edef6a8dcc1d7fee_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F6481A5-6DF5-4a01-BB3C-BC0E179E835E}.exeC:\Windows\{2F6481A5-6DF5-4a01-BB3C-BC0E179E835E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19A37723-171B-4ed6-A908-22D7B0829581}.exeC:\Windows\{19A37723-171B-4ed6-A908-22D7B0829581}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C566DC2D-BFD8-473f-A3AF-733609CF3229}.exeC:\Windows\{C566DC2D-BFD8-473f-A3AF-733609CF3229}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB420AD6-CE41-4892-A8DB-70EEF164B213}.exeC:\Windows\{EB420AD6-CE41-4892-A8DB-70EEF164B213}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0BBB3474-149B-4ded-8A69-7F1540C17278}.exeC:\Windows\{0BBB3474-149B-4ded-8A69-7F1540C17278}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAD9F8B6-7F5B-4310-94D0-534A8E99AB91}.exeC:\Windows\{BAD9F8B6-7F5B-4310-94D0-534A8E99AB91}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{921FDA9C-AA4A-4310-BA16-B4150D4B4BB6}.exeC:\Windows\{921FDA9C-AA4A-4310-BA16-B4150D4B4BB6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDFC2D40-DE23-4839-A47C-F0562E8B0A38}.exeC:\Windows\{BDFC2D40-DE23-4839-A47C-F0562E8B0A38}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B76F4E67-C2C1-42c7-B5F7-7B3266FEF482}.exeC:\Windows\{B76F4E67-C2C1-42c7-B5F7-7B3266FEF482}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F14B566-66BB-4e88-A7C9-51B73BC36AB6}.exeC:\Windows\{1F14B566-66BB-4e88-A7C9-51B73BC36AB6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8F5FC4A-5CB7-417c-88B0-72FCB059D4E4}.exeC:\Windows\{B8F5FC4A-5CB7-417c-88B0-72FCB059D4E4}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F14B~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B76F4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDFC2~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{921FD~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAD9F~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BBB3~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB420~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C566D~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19A37~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F648~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0BBB3474-149B-4ded-8A69-7F1540C17278}.exe
{19A37723-171B-4ed6-A908-22D7B0829581}.exe
{1F14B566-66BB-4e88-A7C9-51B73BC36AB6}.exe
{2F6481A5-6DF5-4a01-BB3C-BC0E179E835E}.exe
{921FDA9C-AA4A-4310-BA16-B4150D4B4BB6}.exe
{B76F4E67-C2C1-42c7-B5F7-7B3266FEF482}.exe
{B8F5FC4A-5CB7-417c-88B0-72FCB059D4E4}.exe
{BAD9F8B6-7F5B-4310-94D0-534A8E99AB91}.exe
{BDFC2D40-DE23-4839-A47C-F0562E8B0A38}.exe
{C566DC2D-BFD8-473f-A3AF-733609CF3229}.exe
{EB420AD6-CE41-4892-A8DB-70EEF164B213}.exe
memory/676-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/676-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2060-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2060-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2316-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2316-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2324-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2324-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2732-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2732-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2920-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2920-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2924-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2924-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3372-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3372-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5096-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5536-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5536-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5560-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5560-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5560-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6000-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6000-6-0x0000000000400000-0x0000000000410000-memory.dmp