Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 15:02
General
- Target 2026-05-03_661b3338b1b481fbd6334b9d12caf8b3_elex_rhadamanthys_smoke-loader_wannacry.exe
- Size 833KB
- Sample260503-sem12se17n
- SHA256 89f2522c5cb8861db6216e03f7ad2dbf1f3c5fe52a0dcf32ff77a3b88ee27489
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_661b3338b1b481fbd6334b9d12caf8b3_elex_rhadamanthys_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_661b3338b1b481fbd6334b9d12caf8b3_elex_rhadamanthys_smoke-loader_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A85406DF-30B3-4255-BDCE-4162E77BB6C7}.exeC:\Windows\{A85406DF-30B3-4255-BDCE-4162E77BB6C7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A9AF35A-FFC8-43f1-B4FD-F4235BC6777D}.exeC:\Windows\{5A9AF35A-FFC8-43f1-B4FD-F4235BC6777D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE6EFE10-4291-4e8b-B648-CD23FAA908F3}.exeC:\Windows\{BE6EFE10-4291-4e8b-B648-CD23FAA908F3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6E5AEA4-F664-4a43-B44C-A7D3CE0FFD28}.exeC:\Windows\{F6E5AEA4-F664-4a43-B44C-A7D3CE0FFD28}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2250B87C-C6FD-418f-B7FC-2308BD03B039}.exeC:\Windows\{2250B87C-C6FD-418f-B7FC-2308BD03B039}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0EAD4E3-AB09-4076-84DD-FA4F2E74E4EA}.exeC:\Windows\{D0EAD4E3-AB09-4076-84DD-FA4F2E74E4EA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{249C1B83-74B0-480d-B3FA-E4810BE7C98E}.exeC:\Windows\{249C1B83-74B0-480d-B3FA-E4810BE7C98E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C371C60-7FBD-41b8-A6B2-47E8F956985B}.exeC:\Windows\{5C371C60-7FBD-41b8-A6B2-47E8F956985B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D84F0AA5-22E0-4bfa-91CE-9AC1B12BC132}.exeC:\Windows\{D84F0AA5-22E0-4bfa-91CE-9AC1B12BC132}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2FD5F5F-B212-41df-88C5-B0EF6D9B1ED5}.exeC:\Windows\{E2FD5F5F-B212-41df-88C5-B0EF6D9B1ED5}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D84F0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C371~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{249C1~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0EAD~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2250B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6E5A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE6EF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A9AF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8540~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2250B87C-C6FD-418f-B7FC-2308BD03B039}.exe
{249C1B83-74B0-480d-B3FA-E4810BE7C98E}.exe
{5A9AF35A-FFC8-43f1-B4FD-F4235BC6777D}.exe
{5C371C60-7FBD-41b8-A6B2-47E8F956985B}.exe
{A85406DF-30B3-4255-BDCE-4162E77BB6C7}.exe
{BE6EFE10-4291-4e8b-B648-CD23FAA908F3}.exe
{D0EAD4E3-AB09-4076-84DD-FA4F2E74E4EA}.exe
{D84F0AA5-22E0-4bfa-91CE-9AC1B12BC132}.exe
{E2FD5F5F-B212-41df-88C5-B0EF6D9B1ED5}.exe
{F6E5AEA4-F664-4a43-B44C-A7D3CE0FFD28}.exe