Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/11/2026, 17:39
General
- Target 2026-11-10_dfc61b15ae00990484ab4a009fb75f2f_elex_remcos_wannacry.exe
- Size 64KB
- Sample261111-v8eb4sag74
- SHA256 78e032e41b7e23814b0532c77846e52124ae8e98f71265394032c4196dee0a17
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-10_dfc61b15ae00990484ab4a009fb75f2f_elex_remcos_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-10_dfc61b15ae00990484ab4a009fb75f2f_elex_remcos_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3210F4F7-60D4-4c01-81D1-68EB99A4B6C3}.exeC:\Windows\{3210F4F7-60D4-4c01-81D1-68EB99A4B6C3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BA1E671-B5C0-4d39-8F6F-6AE820B38347}.exeC:\Windows\{9BA1E671-B5C0-4d39-8F6F-6AE820B38347}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{56A12D8C-9D60-486f-838E-E42EC6EE880E}.exeC:\Windows\{56A12D8C-9D60-486f-838E-E42EC6EE880E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEB064C5-AE5D-4dab-B8B4-B32D83454058}.exeC:\Windows\{AEB064C5-AE5D-4dab-B8B4-B32D83454058}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F085CCD-8186-4b8e-8C82-53A3F5AC3101}.exeC:\Windows\{9F085CCD-8186-4b8e-8C82-53A3F5AC3101}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6B43C01-C21E-484b-9AA8-01F9356F16D9}.exeC:\Windows\{B6B43C01-C21E-484b-9AA8-01F9356F16D9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C8CF45D-3B6F-49ca-826C-D532CE1C4CFC}.exeC:\Windows\{0C8CF45D-3B6F-49ca-826C-D532CE1C4CFC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAEFF86C-9200-485b-8F6D-FC1AFE3940E5}.exeC:\Windows\{AAEFF86C-9200-485b-8F6D-FC1AFE3940E5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C73D564-B91C-4561-ABAE-826C027DBFF9}.exeC:\Windows\{9C73D564-B91C-4561-ABAE-826C027DBFF9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{302471A7-44A6-4e66-BAA4-311E92A9C8DF}.exeC:\Windows\{302471A7-44A6-4e66-BAA4-311E92A9C8DF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA468F04-7957-4bb2-ADFC-8607635653FD}.exeC:\Windows\{DA468F04-7957-4bb2-ADFC-8607635653FD}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30247~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C73D~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAEFF~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C8CF~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6B43~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F085~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEB06~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{56A12~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BA1E~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3210F~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0C8CF45D-3B6F-49ca-826C-D532CE1C4CFC}.exe
{302471A7-44A6-4e66-BAA4-311E92A9C8DF}.exe
{3210F4F7-60D4-4c01-81D1-68EB99A4B6C3}.exe
{56A12D8C-9D60-486f-838E-E42EC6EE880E}.exe
{9BA1E671-B5C0-4d39-8F6F-6AE820B38347}.exe
{9C73D564-B91C-4561-ABAE-826C027DBFF9}.exe
{9F085CCD-8186-4b8e-8C82-53A3F5AC3101}.exe
{AAEFF86C-9200-485b-8F6D-FC1AFE3940E5}.exe
{AEB064C5-AE5D-4dab-B8B4-B32D83454058}.exe
{B6B43C01-C21E-484b-9AA8-01F9356F16D9}.exe
{DA468F04-7957-4bb2-ADFC-8607635653FD}.exe
memory/972-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/972-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/972-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1036-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1036-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1036-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1192-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1192-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1212-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1212-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1560-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1560-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4064-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4064-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4244-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4244-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4840-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5196-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5196-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5208-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5208-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5232-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5232-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5700-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5700-58-0x0000000000400000-0x0000000000410000-memory.dmp