18a4849e642d487fe958722db9594367a59a6fccef1afcdacdb31a4bd1cfce26

General

Target
2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe
Size 64KB
Sample261027-rhnlbaev9l
SHA256 18a4849e642d487fe958722db9594367a59a6fccef1afcdacdb31a4bd1cfce26
MD5 779efbef0b300f3918172f2e0d2d792b
SHA1 1cce87bc014e22abf9914476aca44bb29b136dbc
SHA512 e07e16d00cc8bfffe2de55b103c39ad9d5302cc861c6c3c9060543a34a59fbe2617c65494d75d82b0f0911e6b1eaa82ffd6b246d10c2ae45fc568beffbcb142a
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNs4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNs4/QQzlhpB
TLSH
T1F9532A436F6A4CF2F3511175086E9F79973B89E4C16EFE9FAB80DD088462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Custom signature

Detects Windows executables referencing non-Windows User-Agents 6 IoCs

resource	yara_rule
behavioral1/files/0x000700000002434f-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024351-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024359-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024351-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0002000000021d94-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00030000000006d5-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 6 IoCs

pid	Process
1852	c16668E93fFA00248308BB9AfD9C33784A342z.exe
1824	c43B748A8fE11724a288B641f9D4732DE839Fz.exe
216	cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe
376	c34A4D399f226D24d238B93DfF2127058CCCFz.exe
2320	c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe
4436	c83724B44fC5C324adb895D6f0DDBCF5F3CD4z.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\c16668E93fFA00248308BB9AfD9C33784A342z.exe	2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe
File created	C:\Windows\c43B748A8fE11724a288B641f9D4732DE839Fz.exe	c16668E93fFA00248308BB9AfD9C33784A342z.exe
File created	C:\Windows\cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe	c43B748A8fE11724a288B641f9D4732DE839Fz.exe
File created	C:\Windows\c34A4D399f226D24d238B93DfF2127058CCCFz.exe	cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe
File created	C:\Windows\c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe	c34A4D399f226D24d238B93DfF2127058CCCFz.exe
File created	C:\Windows\c83724B44fC5C324adb895D6f0DDBCF5F3CD4z.exe	c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4080	cmd.exe
4612	cmd.exe
1144	cmd.exe
4380	cmd.exe
4860	cmd.exe
220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c43B748A8fE11724a288B641f9D4732DE839Fz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c83724B44fC5C324adb895D6f0DDBCF5F3CD4z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c16668E93fFA00248308BB9AfD9C33784A342z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c34A4D399f226D24d238B93DfF2127058CCCFz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2488	2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	1852	c16668E93fFA00248308BB9AfD9C33784A342z.exe
Token: SeIncBasePriorityPrivilege	1824	c43B748A8fE11724a288B641f9D4732DE839Fz.exe
Token: SeIncBasePriorityPrivilege	216	cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe
Token: SeIncBasePriorityPrivilege	376	c34A4D399f226D24d238B93DfF2127058CCCFz.exe
Token: SeIncBasePriorityPrivilege	2320	c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 1852	2488	2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe	91
PID 2488 wrote to memory of 4380	2488	2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe	92
PID 1852 wrote to memory of 1824	1852	c16668E93fFA00248308BB9AfD9C33784A342z.exe	93
PID 1852 wrote to memory of 4860	1852	c16668E93fFA00248308BB9AfD9C33784A342z.exe	94
PID 1824 wrote to memory of 216	1824	c43B748A8fE11724a288B641f9D4732DE839Fz.exe	97
PID 1824 wrote to memory of 220	1824	c43B748A8fE11724a288B641f9D4732DE839Fz.exe	98
PID 216 wrote to memory of 376	216	cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe	99
PID 216 wrote to memory of 4080	216	cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe	100
PID 376 wrote to memory of 2320	376	c34A4D399f226D24d238B93DfF2127058CCCFz.exe	101
PID 376 wrote to memory of 4612	376	c34A4D399f226D24d238B93DfF2127058CCCFz.exe	102
PID 2320 wrote to memory of 4436	2320	c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe	103
PID 2320 wrote to memory of 1144	2320	c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_779efbef0b300f3918172f2e0d2d792b_elex_remcos_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\c16668E93fFA00248308BB9AfD9C33784A342z.exe
  C:\Windows\c16668E93fFA00248308BB9AfD9C33784A342z.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\c43B748A8fE11724a288B641f9D4732DE839Fz.exe
    C:\Windows\c43B748A8fE11724a288B641f9D4732DE839Fz.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe
      C:\Windows\cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:216
    - - C:\Windows\c34A4D399f226D24d238B93DfF2127058CCCFz.exe
        
        C:\Windows\c34A4D399f226D24d238B93DfF2127058CCCFz.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:376
      - C:\Windows\c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe
        
        C:\Windows\c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\c83724B44fC5C324adb895D6f0DDBCF5F3CD4z.exe
        
        C:\Windows\c83724B44fC5C324adb895D6f0DDBCF5F3CD4z.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C63ADE~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1144
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\C34A4D~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4612
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\CFFB0F~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4080
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\C43B74~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\C16668~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

c16668E93fFA00248308BB9AfD9C33784A342z.exe

Path C:\Windows\c16668E93fFA00248308BB9AfD9C33784A342z.exe
Size 64KB
SHA256 c3be44633bdd4f38c4a9596b0d9ff2816e0514fe0aae21d246d7be20f49119c3
MD5 8dde6be4b7881a669f5f2b636efe3afe
SHA1 f06506d47a8252534f8fcdbaf15d40684108e5ea
SHA512 17b7b93a0b1012d523e8f77e159aac886abcedbe9a654d70d5c81abf498d89eb3cb6d3dd0fb88db0fca1452b1bf0e02ed5cb195f5779cb56c16a8dd7be46b8ea
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNq4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNq4/QQzlhpB
TLSH
T1E5532B436F694CF2F3511175086E9F79972B89E4C16EFE9FAB80DD084462681FC3A606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c34A4D399f226D24d238B93DfF2127058CCCFz.exe

Path C:\Windows\c34A4D399f226D24d238B93DfF2127058CCCFz.exe
Size 64KB
SHA256 c619b90fdb608dde26bebd7df87c203897b289ab030718477da2eb2a06818c09
MD5 dba63d48d3e2b0f014acf03741d91649
SHA1 d0a59e923ff46eed7333bb1e7bca10733975fb51
SHA512 d73f2f68bfe96f1bcea58e70731106048a9e8c918e380afe6e8e1df07558159ec7b02375da1cccb480218d3cbdf2a45b15d5d0fb4b246c9c282a556d2fd23302
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjN4i4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNj4/QQzlhpB
TLSH
T164533A436F6A4CF2F3511175086E9F79973B89E4C16EFE9FAB80DD088462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c43B748A8fE11724a288B641f9D4732DE839Fz.exe

Path C:\Windows\c43B748A8fE11724a288B641f9D4732DE839Fz.exe
Size 64KB
SHA256 165a8876ce847ea9ab19a3570890b1b047080a1055e2e9ab66cfafee22f429c3
MD5 07e65c47a10ec8d5ddc43b7f58e4443b
SHA1 cd787f2c90aff853349a68b2be3f38b98ef529b6
SHA512 f3d461dbdb64966712f7bd3d49d974764ffa3b75c3b5d21a6ec94fb26b26ba66e3d29a12064a61944dfef7c074d26d3dc54fc0eb47906506b5cdbe8d3cf85000
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNw4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNw4/QQzlhpB
TLSH
T1FC532B436F694CF2F3511175086E9F79972B89E4C16EFE9FAB80DD084462681FC39606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe

Path C:\Windows\c63ADE84Df5AAC24d4688E59fE22577A968E0z.exe
Size 64KB
SHA256 156391c9fc6d6322093e8c1c6a743ca27aa455fee97c09c7aa0472aaa3605483
MD5 d1f214a38e7e43b8c8b543923e5068c0
SHA1 4045a6137a6c9a90a1739aa4f6fb497b58366ae2
SHA512 a1687cc6e3a13f1a2546ec84555f86870f902d5656144ee83204f9e5ef81d5be823a08e4e22f2bcd1e1c64847c261754055a9d2f6ba94573ef6d00c7bfb07056
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNA4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNA4/QQzlhpB
TLSH
T135532A436F6A4CF2F3511175086E9F79973B89E4C16EFEDFAB80DD088462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c83724B44fC5C324adb895D6f0DDBCF5F3CD4z.exe

Path C:\Windows\c83724B44fC5C324adb895D6f0DDBCF5F3CD4z.exe
Size 64KB
SHA256 d83f464b108a43f33274db97fdcbe49d03427be9f088e8d0ee0db12d0380b5f0
MD5 2435454b077cb0a0942b65a25a8af500
SHA1 ecb440e3510aa4b6b564a4fe9d3b891c0d72a1cb
SHA512 78aa8821b5791658d27a69d51cc73780541de5f68d4c135c9f2a5fbc13194f12db6119b9e946c88eb217260db35e73cad8d4503785568db5b1c0797a051bb36f
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNe4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNe4/QQzlhpB
TLSH
T16A532B436F694CF2F3511176086E9F79972B89E4C16EFE9FAB80DD084462681F839606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe

Path C:\Windows\cFFB0FDDCfCE162474f8825FfC59E2480A69Cz.exe
Size 64KB
SHA256 a9e87f7470c021d11a98baf1b2365f1217a008a6731c6cf37167b4582d9963a0
MD5 2c67f6460ae1286c84122504ee4c2391
SHA1 6fe9ddab06473831c04b15c9167e556a50fef374
SHA512 a10b455e573d66b82a413ce13a9c7ffbf94dff3cd4b1d6510ea9190ddfbdb803e6ed8209783cf2977a5f0c21022bb8f6bf4d883b2a72455ffbccc4561e84fd33
SSDEEP 384:PjibD2liXsafEHsc4gsFW6e/hHjNy4/ClsrQjlslE6uWB:Pjif24cafxisFW7/hHjNy4/QQzlhpB
TLSH
T155533A436F6A4CF2F3511175086E9F79972B89E4C1AEFEDFAB80CD084462681FC39206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads