Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 11:38
General
- Target 2026-10-22_5eae8497d61e846e3a1e42e44109e477_elex_remcos_rincux_wannacry.exe
- Size 64KB
- Sample261024-nr75jayx6m
- SHA256 f75f0f8a9e6e49a28014630e8a55b06af7d06879607a71ad3c0b1cfbc922793a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 27 IoCs
- Detects Windows executables referencing non-Windows User-Agents 27 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 8 IoCs
- Drops file in Windows directory 8 IoCs
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_5eae8497d61e846e3a1e42e44109e477_elex_remcos_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_5eae8497d61e846e3a1e42e44109e477_elex_remcos_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B4D9518-0136-4b70-877A-789779630A9C}.exeC:\Windows\{3B4D9518-0136-4b70-877A-789779630A9C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7C9BEE81-89AF-4ab4-80F8-8A31DF8EDC3A}.exeC:\Windows\{7C9BEE81-89AF-4ab4-80F8-8A31DF8EDC3A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABDA9705-3BB7-4786-8C25-7AFF668D29DE}.exeC:\Windows\{ABDA9705-3BB7-4786-8C25-7AFF668D29DE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{90D92F88-42A0-47fe-9E70-AD04F5B0ED50}.exeC:\Windows\{90D92F88-42A0-47fe-9E70-AD04F5B0ED50}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0410741-DC78-4c89-B148-F1C18FCACD2C}.exeC:\Windows\{B0410741-DC78-4c89-B148-F1C18FCACD2C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F19D2220-E808-412c-9F35-A685DFF10CA1}.exeC:\Windows\{F19D2220-E808-412c-9F35-A685DFF10CA1}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D97CF94-4D09-4eeb-B1A3-3D7CBDC0BB75}.exeC:\Windows\{5D97CF94-4D09-4eeb-B1A3-3D7CBDC0BB75}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA116C74-1C7F-4d88-8DBB-45D02B03DECA}.exeC:\Windows\{FA116C74-1C7F-4d88-8DBB-45D02B03DECA}.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D97C~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F19D2~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0410~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90D92~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABDA9~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7C9BE~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B4D9~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3B4D9518-0136-4b70-877A-789779630A9C}.exe
{5D97CF94-4D09-4eeb-B1A3-3D7CBDC0BB75}.exe
{7C9BEE81-89AF-4ab4-80F8-8A31DF8EDC3A}.exe
{90D92F88-42A0-47fe-9E70-AD04F5B0ED50}.exe
{ABDA9705-3BB7-4786-8C25-7AFF668D29DE}.exe
{B0410741-DC78-4c89-B148-F1C18FCACD2C}.exe
{F19D2220-E808-412c-9F35-A685DFF10CA1}.exe
{FA116C74-1C7F-4d88-8DBB-45D02B03DECA}.exe
memory/1412-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1412-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1748-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2096-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2096-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2760-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2760-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2760-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2832-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2832-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3536-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3536-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4516-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4516-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4560-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4560-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4560-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4652-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4652-19-0x0000000000400000-0x0000000000410000-memory.dmp