Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/05/2026, 14:36
General
- Target 2026-05-24_bc8d3c14e5ae2fca6be6acb17ba785f9_elex_rincux_wannacry.exe
- Size 60KB
- Sample260524-ry4bpsax8v
- SHA256 68e342a8fef00d8037d45b64197f74bcd32e2d1bec7f20e55bb205acc6fe2489
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_bc8d3c14e5ae2fca6be6acb17ba785f9_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_bc8d3c14e5ae2fca6be6acb17ba785f9_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2AC5AFE6-6C46-41df-8867-F8E9F9F4E5C0}.exeC:\Windows\{2AC5AFE6-6C46-41df-8867-F8E9F9F4E5C0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCAD88C4-66DC-4332-9EC6-A09AED8F4650}.exeC:\Windows\{DCAD88C4-66DC-4332-9EC6-A09AED8F4650}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6ACF1CDB-A5F6-4c7a-B0A1-617D70E00346}.exeC:\Windows\{6ACF1CDB-A5F6-4c7a-B0A1-617D70E00346}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FF9C7C1-CD06-4508-B140-004485589BE1}.exeC:\Windows\{8FF9C7C1-CD06-4508-B140-004485589BE1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D44C1491-ECCF-488c-81B5-1F119F218570}.exeC:\Windows\{D44C1491-ECCF-488c-81B5-1F119F218570}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A97E508-1DAB-4db1-9F86-8589DAF44AA2}.exeC:\Windows\{5A97E508-1DAB-4db1-9F86-8589DAF44AA2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E7B9F7D-C48E-4d7a-B4AB-60A718DA57D5}.exeC:\Windows\{2E7B9F7D-C48E-4d7a-B4AB-60A718DA57D5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF025594-4AA5-4289-89E6-ED333860E88E}.exeC:\Windows\{DF025594-4AA5-4289-89E6-ED333860E88E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBF65315-9FD4-4a56-95F8-BC8A6F5844C5}.exeC:\Windows\{DBF65315-9FD4-4a56-95F8-BC8A6F5844C5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C067AA8-0B3E-4e7a-A0C1-C44574C9E1BD}.exeC:\Windows\{5C067AA8-0B3E-4e7a-A0C1-C44574C9E1BD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC18E129-57FF-46e5-964A-BB4AAFF7EDFD}.exeC:\Windows\{EC18E129-57FF-46e5-964A-BB4AAFF7EDFD}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C067~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBF65~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF025~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E7B9~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A97E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D44C1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FF9C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6ACF1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCAD8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2AC5A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2AC5AFE6-6C46-41df-8867-F8E9F9F4E5C0}.exe
{2E7B9F7D-C48E-4d7a-B4AB-60A718DA57D5}.exe
{5A97E508-1DAB-4db1-9F86-8589DAF44AA2}.exe
{5C067AA8-0B3E-4e7a-A0C1-C44574C9E1BD}.exe
{6ACF1CDB-A5F6-4c7a-B0A1-617D70E00346}.exe
{8FF9C7C1-CD06-4508-B140-004485589BE1}.exe
{D44C1491-ECCF-488c-81B5-1F119F218570}.exe
{DBF65315-9FD4-4a56-95F8-BC8A6F5844C5}.exe
{DCAD88C4-66DC-4332-9EC6-A09AED8F4650}.exe
{DF025594-4AA5-4289-89E6-ED333860E88E}.exe
{EC18E129-57FF-46e5-964A-BB4AAFF7EDFD}.exe