Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
27/10/2026, 18:12
General
- Target 2026-10-26_4b5344783038ba09e07edc90ad062877_elex_remcos_wannacry.exe
- Size 64KB
- Sample261027-ws6bbse151
- SHA256 fdd9184c9213cdd1ee19467dc65bdd21b5b9598bb20634dded4b3c3739d3d423
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Detects Windows executables referencing non-Windows User-Agents 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b5344783038ba09e07edc90ad062877_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_4b5344783038ba09e07edc90ad062877_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EF01271-E43C-44ec-B286-CBE1EEA89F6E}.exeC:\Windows\{0EF01271-E43C-44ec-B286-CBE1EEA89F6E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{432EFEB2-7C6C-4039-8FCF-7683D5B3B174}.exeC:\Windows\{432EFEB2-7C6C-4039-8FCF-7683D5B3B174}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{216BF6EF-9AE9-4398-80EB-5669FED23A09}.exeC:\Windows\{216BF6EF-9AE9-4398-80EB-5669FED23A09}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1C19070-658C-4bc2-90A3-511F5DF1AA48}.exeC:\Windows\{E1C19070-658C-4bc2-90A3-511F5DF1AA48}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0FBB4093-26A3-4bcd-A2C9-52DEF0561B85}.exeC:\Windows\{0FBB4093-26A3-4bcd-A2C9-52DEF0561B85}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE0B4AD3-67DF-4a7b-9A4D-B85FFEDDB599}.exeC:\Windows\{FE0B4AD3-67DF-4a7b-9A4D-B85FFEDDB599}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{589951D8-F8A6-4cd7-B165-45C75E00925F}.exeC:\Windows\{589951D8-F8A6-4cd7-B165-45C75E00925F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D2630D8E-D3A7-40c8-8EA7-0D1487503E0F}.exeC:\Windows\{D2630D8E-D3A7-40c8-8EA7-0D1487503E0F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D85F3CF9-DCF3-4efa-AC18-C1F3151CE242}.exeC:\Windows\{D85F3CF9-DCF3-4efa-AC18-C1F3151CE242}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B598316C-F426-4f61-B73D-769D33468C3F}.exeC:\Windows\{B598316C-F426-4f61-B73D-769D33468C3F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01650220-C4E5-4e48-8D95-AD5300CE5BA3}.exeC:\Windows\{01650220-C4E5-4e48-8D95-AD5300CE5BA3}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B5983~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D85F3~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D2630~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58995~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE0B4~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0FBB4~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1C19~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{216BF~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{432EF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EF01~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{01650220-C4E5-4e48-8D95-AD5300CE5BA3}.exe
{0EF01271-E43C-44ec-B286-CBE1EEA89F6E}.exe
{0FBB4093-26A3-4bcd-A2C9-52DEF0561B85}.exe
{216BF6EF-9AE9-4398-80EB-5669FED23A09}.exe
{432EFEB2-7C6C-4039-8FCF-7683D5B3B174}.exe
{589951D8-F8A6-4cd7-B165-45C75E00925F}.exe
{B598316C-F426-4f61-B73D-769D33468C3F}.exe
{D2630D8E-D3A7-40c8-8EA7-0D1487503E0F}.exe
{D85F3CF9-DCF3-4efa-AC18-C1F3151CE242}.exe
{E1C19070-658C-4bc2-90A3-511F5DF1AA48}.exe
{FE0B4AD3-67DF-4a7b-9A4D-B85FFEDDB599}.exe
memory/1556-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1776-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2484-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2484-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4392-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4488-10-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4488-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4540-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4604-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4604-39-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4608-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4608-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4608-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4772-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4772-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4780-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4780-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5052-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5052-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5108-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5108-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5108-41-0x0000000000400000-0x0000000000410000-memory.dmp