Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 19:51
General
- Target 2026-10-30_acc9d052b6b4be56626c7cf79cbbf5b8_elex_remcos_wannacry.exe
- Size 60KB
- Sample261030-yk52psey2w
- SHA256 35ff415768e098dac27d25c08cf6b86191e80963d6f07e9d5a2df21c5d5bfe13
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_acc9d052b6b4be56626c7cf79cbbf5b8_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_acc9d052b6b4be56626c7cf79cbbf5b8_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7BB6499-C534-479e-B675-1EB0D9BFF308}.exeC:\Windows\{E7BB6499-C534-479e-B675-1EB0D9BFF308}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDCFAF80-077D-42da-AAC2-3DBE11B9FD80}.exeC:\Windows\{BDCFAF80-077D-42da-AAC2-3DBE11B9FD80}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{500565C1-E8E9-447f-9A6E-4E32D350231A}.exeC:\Windows\{500565C1-E8E9-447f-9A6E-4E32D350231A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D756019B-9703-41f2-9E57-254FC1B9A5DB}.exeC:\Windows\{D756019B-9703-41f2-9E57-254FC1B9A5DB}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5703434-93E3-41f1-8F68-B0846DA22916}.exeC:\Windows\{E5703434-93E3-41f1-8F68-B0846DA22916}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC453FF3-E1C0-4d8d-8458-A1EC5AAD05F7}.exeC:\Windows\{FC453FF3-E1C0-4d8d-8458-A1EC5AAD05F7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{116FD55E-4B85-413e-80DC-91E79DD457BA}.exeC:\Windows\{116FD55E-4B85-413e-80DC-91E79DD457BA}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F1A9FFD-2A7A-4697-8DA2-6F95461308C5}.exeC:\Windows\{2F1A9FFD-2A7A-4697-8DA2-6F95461308C5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3D2B8F1-4A67-4935-80E2-AA38F5B28B99}.exeC:\Windows\{A3D2B8F1-4A67-4935-80E2-AA38F5B28B99}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B6F67DA-DA42-4c1d-B214-5C55EB376104}.exeC:\Windows\{1B6F67DA-DA42-4c1d-B214-5C55EB376104}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31898D2F-389B-414a-9AE3-6EF1D0FC981B}.exeC:\Windows\{31898D2F-389B-414a-9AE3-6EF1D0FC981B}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B6F6~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3D2B~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F1A9~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{116FD~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC453~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5703~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7560~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50056~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDCFA~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7BB6~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{116FD55E-4B85-413e-80DC-91E79DD457BA}.exe
{1B6F67DA-DA42-4c1d-B214-5C55EB376104}.exe
{2F1A9FFD-2A7A-4697-8DA2-6F95461308C5}.exe
{31898D2F-389B-414a-9AE3-6EF1D0FC981B}.exe
{500565C1-E8E9-447f-9A6E-4E32D350231A}.exe
{A3D2B8F1-4A67-4935-80E2-AA38F5B28B99}.exe
{BDCFAF80-077D-42da-AAC2-3DBE11B9FD80}.exe
{D756019B-9703-41f2-9E57-254FC1B9A5DB}.exe
{E5703434-93E3-41f1-8F68-B0846DA22916}.exe
{E7BB6499-C534-479e-B675-1EB0D9BFF308}.exe
{FC453FF3-E1C0-4d8d-8458-A1EC5AAD05F7}.exe