stormser | 5bd38277df8c81edff60d1b5f024312a5d8890072b42eeae889efd594e231167

General

Target
2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Size 90KB
Sample260425-e35zwaft7z
SHA256 5bd38277df8c81edff60d1b5f024312a5d8890072b42eeae889efd594e231167
MD5 8b37a81111afefc593771588eba0a215
SHA1 e10752643c4922cd324362d103ccf1fd71b445fc
SHA512 cee277c7ed6b49f23b8cdb0fccc116bdda45c9bbd86ebcdefa7a4e8d1625a54dc8797d65ea63d8498dd4e1adf0a17677ef0c03cdd610b54c1d88e641cb59b2f0
SSDEEP 768:Qvw9816vhKQLroS4/wQRNrfrunMxVFA3b7gl/:YEGh0oSl2unMxVS3HgR
TLSH
T15893B43D5DDA1037E2B7D6B585F126E3FE66B983360A1D0E469243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x000800000002448b-2.dat	family_stormser
behavioral1/files/0x000800000002448c-6.dat	family_stormser
behavioral1/files/0x0007000000024498-10.dat	family_stormser
behavioral1/files/0x000a00000002448c-14.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7878B05-EE89-4adc-B744-75A1AE10A41A}	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A7878B05-EE89-4adc-B744-75A1AE10A41A}\stubpath = "C:\\Windows\\{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe"	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}\stubpath = "C:\\Windows\\{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe"	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}\stubpath = "C:\\Windows\\{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe"	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}\stubpath = "C:\\Windows\\{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe"	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe

Executes dropped EXE 4 IoCs

pid	Process
1052	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
4396	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
4944	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
2708	{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
File created	C:\Windows\{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
File created	C:\Windows\{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
File created	C:\Windows\{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4676	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1052	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
Token: SeIncBasePriorityPrivilege	4396	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
Token: SeIncBasePriorityPrivilege	4944	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 1052	4676	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe	86
PID 4676 wrote to memory of 4692	4676	2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe	87
PID 1052 wrote to memory of 4396	1052	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe	88
PID 1052 wrote to memory of 1212	1052	{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe	89
PID 4396 wrote to memory of 4944	4396	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe	92
PID 4396 wrote to memory of 4972	4396	{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe	93
PID 4944 wrote to memory of 2708	4944	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe	94
PID 4944 wrote to memory of 3264	4944	{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_8b37a81111afefc593771588eba0a215_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
  C:\Windows\{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
    C:\Windows\{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
      C:\Windows\{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe
        
        C:\Windows\{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2708
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A7878~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FCACA~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5B6AB~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe

Path C:\Windows\{5B6AB6DA-AEBC-4c4f-80FE-C0CC204A8E01}.exe
Size 90KB
SHA256 744a2035c1731b0fd62501aff90568bf053a5a51fb71c8377a1e478c0becc517
MD5 6434110e9301c5c46ac3c1a7400993e0
SHA1 1401f872b956ba63a6c34960c685f69871c8452b
SHA512 3b0e35fffac13a36c0c162313dea4fd0c8654cd923410691d03551e1d5dfe0c9b06082aae50d9fb37c2367447e76cbe7607b0ea2c6e4312e162d689256f2c3f5
SSDEEP 768:Qvw9816vhKQLro84/wQRNrfrunMxVFA3b7gl/:YEGh0o8l2unMxVS3HgR
TLSH
T1BB93B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe

Path C:\Windows\{A7878B05-EE89-4adc-B744-75A1AE10A41A}.exe
Size 90KB
SHA256 b86502c9b48592ff5b62d876760b3a6f44777701dcaa88aa1664abc4043b11bf
MD5 9c624613b9dc44e8f2961c05255aec0e
SHA1 547f762084f1e02ac160e7e2598a0282f6ab14c3
SHA512 8de292110ab0a3670cdc4dadc36d59fa68eedd1e607627ebb311546b0044343f12165c33544476c7c2fe856389516702aeb73ddf50cd7bcef70d4b921b4a0eb2
SSDEEP 768:Qvw9816vhKQLroY4/wQRNrfrunMxVFA3b7gl/:YEGh0oYl2unMxVS3HgR
TLSH
T15293B43D5DDA1037E277D6B585F126E3FE66B983350A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe

Path C:\Windows\{C6C1A9FA-9225-40c7-A6AD-D14AE51A5A10}.exe
Size 90KB
SHA256 9414be0fffc518184d53de2ae873d8337aa5b4af18928fd4aa276df0ffd89201
MD5 085bc5d11de6d6dbac01194f4973c598
SHA1 1550899a105ba654dd9484fb59868678bf20c97f
SHA512 716757b27757e737112efff422d10ee655b72c0b5d9fbf53a26859b7e39eadca8e737659b3dd67536bb956284fe03112633fe2c9be0ce5b54a893af96f20ba1c
SSDEEP 768:Qvw9816vhKQLrob4/wQRNrfrunMxVFA3b7gl/:YEGh0obl2unMxVS3HgR
TLSH
T10A93B43D5DDA1037E2B7D6B585F126E3FE66B983390A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe

Path C:\Windows\{FCACAFB9-CA25-416c-9925-A63EBBF65B7D}.exe
Size 90KB
SHA256 2fbb8de33efccbc191133b63d1dfba5e5765f678d28cdceb7997865a3bb8eab9
MD5 aaac6564e9a06e13458943bf68aa1d3b
SHA1 1efb8ac40a2f358cd1e0c376a0f0776f96c4a919
SHA512 2ccc45e5b28074b01c1c165f93ba73fce425e5f959e680e4674958796c8e2380bb8084bc3a37073871e96f239123fc1c370eb31cbad27708e2cc1984e0c67bac
SSDEEP 768:Qvw9816vhKQLro+4/wQRNrfrunMxVFA3b7gl/:YEGh0o+l2unMxVS3HgR
TLSH
T1C693B43D5DDA103BE2B7D6B585F126E3FE66B983350A1D0E46D243428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads