Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/05/2026, 12:08
General
- Target 2026-05-05_600c2d1cc7a47faefac2d7c7ca6c9ba8_elex_rhadamanthys_wannacry.exe
- Size 161KB
- Sample260505-pawkvaaz6p
- SHA256 3bcbc74c530435eaaab4e02b92c9d22bd33e3e7d999a23b360c5655bb690ca7d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_600c2d1cc7a47faefac2d7c7ca6c9ba8_elex_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_600c2d1cc7a47faefac2d7c7ca6c9ba8_elex_rhadamanthys_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1201F23C-4C5B-4053-AC51-8F7636290169}.exeC:\Windows\{1201F23C-4C5B-4053-AC51-8F7636290169}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B3BB9A0-93BB-4bb4-8D2A-D49A460876A5}.exeC:\Windows\{4B3BB9A0-93BB-4bb4-8D2A-D49A460876A5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE1F37FB-A14E-4898-9E17-E0442878B616}.exeC:\Windows\{BE1F37FB-A14E-4898-9E17-E0442878B616}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9079973C-F151-4501-90AA-BC34CC2AF899}.exeC:\Windows\{9079973C-F151-4501-90AA-BC34CC2AF899}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{890F2003-533C-4153-AAA0-4166AD8179BD}.exeC:\Windows\{890F2003-533C-4153-AAA0-4166AD8179BD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B2A2C43-C1C7-4fc7-BF2E-BDD2F76CDE68}.exeC:\Windows\{6B2A2C43-C1C7-4fc7-BF2E-BDD2F76CDE68}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A709147D-941E-4607-9872-0F3010A81699}.exeC:\Windows\{A709147D-941E-4607-9872-0F3010A81699}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2EA4022-027E-4ffb-B236-29802B2F78EC}.exeC:\Windows\{E2EA4022-027E-4ffb-B236-29802B2F78EC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D75413E3-DF89-4375-AF49-17F0903121CD}.exeC:\Windows\{D75413E3-DF89-4375-AF49-17F0903121CD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{430891E4-5B74-4b32-A01D-EDF64EDF3869}.exeC:\Windows\{430891E4-5B74-4b32-A01D-EDF64EDF3869}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4523B5D0-169F-4e7e-9D5D-689870C568F5}.exeC:\Windows\{4523B5D0-169F-4e7e-9D5D-689870C568F5}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43089~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7541~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2EA4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7091~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B2A2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{890F2~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90799~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE1F3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B3BB~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1201F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1201F23C-4C5B-4053-AC51-8F7636290169}.exe
{430891E4-5B74-4b32-A01D-EDF64EDF3869}.exe
{4523B5D0-169F-4e7e-9D5D-689870C568F5}.exe
{4B3BB9A0-93BB-4bb4-8D2A-D49A460876A5}.exe
{6B2A2C43-C1C7-4fc7-BF2E-BDD2F76CDE68}.exe
{890F2003-533C-4153-AAA0-4166AD8179BD}.exe
{9079973C-F151-4501-90AA-BC34CC2AF899}.exe
{A709147D-941E-4607-9872-0F3010A81699}.exe
{BE1F37FB-A14E-4898-9E17-E0442878B616}.exe
{D75413E3-DF89-4375-AF49-17F0903121CD}.exe
{E2EA4022-027E-4ffb-B236-29802B2F78EC}.exe
memory/416-60-0x00000000021D0000-0x00000000022AA000-memory.dmp
memory/416-64-0x00000000021D0000-0x00000000022AA000-memory.dmp
memory/484-52-0x0000000002140000-0x000000000221A000-memory.dmp
memory/484-48-0x0000000002140000-0x000000000221A000-memory.dmp
memory/796-28-0x0000000003C90000-0x0000000003D6A000-memory.dmp
memory/796-24-0x0000000003C90000-0x0000000003D6A000-memory.dmp
memory/1660-34-0x0000000003C70000-0x0000000003D4A000-memory.dmp
memory/1660-30-0x0000000003C70000-0x0000000003D4A000-memory.dmp
memory/2476-0-0x0000000003CB0000-0x0000000003D8A000-memory.dmp
memory/2476-5-0x0000000003CB0000-0x0000000003D8A000-memory.dmp
memory/3128-12-0x0000000003C40000-0x0000000003D1A000-memory.dmp
memory/3128-16-0x0000000003C40000-0x0000000003D1A000-memory.dmp
memory/3152-6-0x00000000020C0000-0x000000000219A000-memory.dmp
memory/3152-10-0x00000000020C0000-0x000000000219A000-memory.dmp
memory/3588-42-0x0000000003C30000-0x0000000003D0A000-memory.dmp
memory/3588-46-0x0000000003C30000-0x0000000003D0A000-memory.dmp
memory/4012-54-0x0000000003C80000-0x0000000003D5A000-memory.dmp
memory/4012-58-0x0000000003C80000-0x0000000003D5A000-memory.dmp
memory/5112-36-0x0000000003C80000-0x0000000003D5A000-memory.dmp
memory/5112-41-0x0000000003C80000-0x0000000003D5A000-memory.dmp
memory/5492-18-0x0000000002220000-0x00000000022FA000-memory.dmp
memory/5492-22-0x0000000002220000-0x00000000022FA000-memory.dmp