Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/05/2026, 04:48
General
- Target 2026-05-10_75fc8ec4add705aa0cd46543f53bc44e_elex_rincux_wannacry.exe
- Size 64KB
- Sample260510-fe63pshs5t
- SHA256 15214a3bebb54d86d739531c0b562c7299e8d210deb069ae2d83115d04e30e40
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-10_75fc8ec4add705aa0cd46543f53bc44e_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-10_75fc8ec4add705aa0cd46543f53bc44e_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0C8750D-ECFC-4582-93C3-8E3295215486}.exeC:\Windows\{B0C8750D-ECFC-4582-93C3-8E3295215486}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF06E72E-4F82-4e18-A9C6-13B97C86C951}.exeC:\Windows\{AF06E72E-4F82-4e18-A9C6-13B97C86C951}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4CA068B6-1AB5-488b-9FD7-61F2E31C0FD2}.exeC:\Windows\{4CA068B6-1AB5-488b-9FD7-61F2E31C0FD2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{430E40A9-AD37-404f-A51D-3834A61E21B2}.exeC:\Windows\{430E40A9-AD37-404f-A51D-3834A61E21B2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F0B2FC6-AC56-4fa5-983A-A07A843DFA43}.exeC:\Windows\{4F0B2FC6-AC56-4fa5-983A-A07A843DFA43}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC873464-EA4D-473b-836A-3504A839E826}.exeC:\Windows\{DC873464-EA4D-473b-836A-3504A839E826}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52A45EBB-E84B-4f6a-8E57-B0AB6FFF996D}.exeC:\Windows\{52A45EBB-E84B-4f6a-8E57-B0AB6FFF996D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB5A3932-CA8D-4acd-B1EF-1C79E7A3496B}.exeC:\Windows\{FB5A3932-CA8D-4acd-B1EF-1C79E7A3496B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8871C01D-42B5-4cb0-B6D0-33ADB85C0C89}.exeC:\Windows\{8871C01D-42B5-4cb0-B6D0-33ADB85C0C89}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB070D4E-851B-472f-843D-9A4F7CBCD83E}.exeC:\Windows\{AB070D4E-851B-472f-843D-9A4F7CBCD83E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8EC297A-CA2F-4e39-9E6C-FA48CF940F3F}.exeC:\Windows\{B8EC297A-CA2F-4e39-9E6C-FA48CF940F3F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB070~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8871C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB5A3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52A45~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC873~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F0B2~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{430E4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CA06~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF06E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0C87~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{430E40A9-AD37-404f-A51D-3834A61E21B2}.exe
{4CA068B6-1AB5-488b-9FD7-61F2E31C0FD2}.exe
{4F0B2FC6-AC56-4fa5-983A-A07A843DFA43}.exe
{52A45EBB-E84B-4f6a-8E57-B0AB6FFF996D}.exe
{8871C01D-42B5-4cb0-B6D0-33ADB85C0C89}.exe
{AB070D4E-851B-472f-843D-9A4F7CBCD83E}.exe
{AF06E72E-4F82-4e18-A9C6-13B97C86C951}.exe
{B0C8750D-ECFC-4582-93C3-8E3295215486}.exe
{B8EC297A-CA2F-4e39-9E6C-FA48CF940F3F}.exe
{DC873464-EA4D-473b-836A-3504A839E826}.exe
{FB5A3932-CA8D-4acd-B1EF-1C79E7A3496B}.exe
memory/1992-81-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1992-87-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/1992-83-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/1992-88-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2576-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2576-63-0x0000000000640000-0x00000000006DC000-memory.dmp
memory/2576-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2576-59-0x0000000000640000-0x00000000006DC000-memory.dmp
memory/2728-71-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/2728-73-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2728-67-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/2728-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3080-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3080-8-0x0000000000980000-0x0000000000A1C000-memory.dmp
memory/3080-1-0x0000000000980000-0x0000000000A1C000-memory.dmp
memory/3080-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3080-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3148-89-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3152-10-0x00000000008B0000-0x000000000094C000-memory.dmp
memory/3152-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3152-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3152-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3152-14-0x00000000008B0000-0x000000000094C000-memory.dmp
memory/4192-51-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/4192-55-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/4192-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4192-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4516-74-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4516-75-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/4516-80-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4516-79-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/4788-39-0x0000000000860000-0x00000000008FC000-memory.dmp
memory/4788-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4788-35-0x0000000000860000-0x00000000008FC000-memory.dmp
memory/4916-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4916-19-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/4916-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4916-23-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/5084-31-0x00000000008C0000-0x000000000095C000-memory.dmp
memory/5084-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5084-27-0x00000000008C0000-0x000000000095C000-memory.dmp
memory/5084-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5168-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5168-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5168-43-0x0000000000830000-0x00000000008CC000-memory.dmp
memory/5168-47-0x0000000000830000-0x00000000008CC000-memory.dmp