Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 10:30
General
- Target 2026-10-22_66fd04c6adeede861e795958743e4705_elex_remcos_wannacry.exe
- Size 60KB
- Sample261024-mjst7sa19l
- SHA256 3e45322ea5253e08526b97016dae24adc12a71e61f3e511e3fc9fe49c596b521
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_66fd04c6adeede861e795958743e4705_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_66fd04c6adeede861e795958743e4705_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{375D729C-5692-41bb-BE23-B50D0CFC50D5}.exeC:\Windows\{375D729C-5692-41bb-BE23-B50D0CFC50D5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EAD09BC9-AA5E-4c44-A290-A5354048F191}.exeC:\Windows\{EAD09BC9-AA5E-4c44-A290-A5354048F191}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BC9D66F-56BB-476f-8546-978B4FACD1E5}.exeC:\Windows\{5BC9D66F-56BB-476f-8546-978B4FACD1E5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2BFE1EE-A077-4521-8CE2-29F79F2BDE35}.exeC:\Windows\{C2BFE1EE-A077-4521-8CE2-29F79F2BDE35}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB4A8591-5F83-4fe3-9C56-0F42A78946E6}.exeC:\Windows\{DB4A8591-5F83-4fe3-9C56-0F42A78946E6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17D81708-D486-45f6-948F-8DC9A2CDC15B}.exeC:\Windows\{17D81708-D486-45f6-948F-8DC9A2CDC15B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{59ECD83F-D6F3-44c0-82B9-A4EB292205A0}.exeC:\Windows\{59ECD83F-D6F3-44c0-82B9-A4EB292205A0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B5C5C926-3EC1-48d2-A3BD-B42C85928297}.exeC:\Windows\{B5C5C926-3EC1-48d2-A3BD-B42C85928297}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AB3E6CB-F1D7-410d-A1B7-07EBE8394396}.exeC:\Windows\{3AB3E6CB-F1D7-410d-A1B7-07EBE8394396}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9224C7A9-F323-472a-9CB0-8018094184CD}.exeC:\Windows\{9224C7A9-F323-472a-9CB0-8018094184CD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEEF2A6C-264B-4829-9024-383201244B54}.exeC:\Windows\{CEEF2A6C-264B-4829-9024-383201244B54}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9224C~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AB3E~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5C5C~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59ECD~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17D81~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB4A8~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2BFE~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5BC9D~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EAD09~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{375D7~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{17D81708-D486-45f6-948F-8DC9A2CDC15B}.exe
{375D729C-5692-41bb-BE23-B50D0CFC50D5}.exe
{3AB3E6CB-F1D7-410d-A1B7-07EBE8394396}.exe
{59ECD83F-D6F3-44c0-82B9-A4EB292205A0}.exe
{5BC9D66F-56BB-476f-8546-978B4FACD1E5}.exe
{9224C7A9-F323-472a-9CB0-8018094184CD}.exe
{B5C5C926-3EC1-48d2-A3BD-B42C85928297}.exe
{C2BFE1EE-A077-4521-8CE2-29F79F2BDE35}.exe
{CEEF2A6C-264B-4829-9024-383201244B54}.exe
{DB4A8591-5F83-4fe3-9C56-0F42A78946E6}.exe
{EAD09BC9-AA5E-4c44-A290-A5354048F191}.exe
memory/460-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1096-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1096-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1096-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1204-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1204-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1308-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1308-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2272-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2272-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2272-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2896-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2896-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3176-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3176-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3436-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3436-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4092-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4092-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4676-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4676-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6028-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6028-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6068-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6068-57-0x0000000000400000-0x0000000000410000-memory.dmp