Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
29/06/2026, 20:55
General
- Target 2026-06-25_989038e4f3dc45bae868092708fbef8a_elex_rhadamanthys_wannacry.exe
- Size 161KB
- Sample260629-zqfvfafs21
- SHA256 ace29b00a2c52b8348e44dfbc5fd695bf224af90acbde6524e3967b269590f8e
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_989038e4f3dc45bae868092708fbef8a_elex_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_989038e4f3dc45bae868092708fbef8a_elex_rhadamanthys_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AD13CB1-7D4A-4a8e-8238-60914BFBC48D}.exeC:\Windows\{3AD13CB1-7D4A-4a8e-8238-60914BFBC48D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{25AD85C5-4C81-42f4-BE96-19274E012882}.exeC:\Windows\{25AD85C5-4C81-42f4-BE96-19274E012882}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8442A961-1374-44b5-875F-0D928052C16F}.exeC:\Windows\{8442A961-1374-44b5-875F-0D928052C16F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAA02BA5-7AD1-4e60-818F-C720F8D74B5E}.exeC:\Windows\{CAA02BA5-7AD1-4e60-818F-C720F8D74B5E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{08F69C4C-6760-4861-B5DD-441D4CC3BBF3}.exeC:\Windows\{08F69C4C-6760-4861-B5DD-441D4CC3BBF3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99499375-5397-4483-83F7-5B6186A257D9}.exeC:\Windows\{99499375-5397-4483-83F7-5B6186A257D9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFE80D8D-4CA7-4643-9495-053BDE050A7A}.exeC:\Windows\{CFE80D8D-4CA7-4643-9495-053BDE050A7A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B40BEE71-5822-4f51-8C4C-5E21025D8BE4}.exeC:\Windows\{B40BEE71-5822-4f51-8C4C-5E21025D8BE4}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F3D83AEF-8046-478f-BEF9-397C641A00DE}.exeC:\Windows\{F3D83AEF-8046-478f-BEF9-397C641A00DE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F934803F-083F-4c72-9B0C-877869697C0B}.exeC:\Windows\{F934803F-083F-4c72-9B0C-877869697C0B}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F3D83~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B40BE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFE80~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99499~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{08F69~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAA02~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8442A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25AD8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AD13~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{08F69C4C-6760-4861-B5DD-441D4CC3BBF3}.exe
{25AD85C5-4C81-42f4-BE96-19274E012882}.exe
{3AD13CB1-7D4A-4a8e-8238-60914BFBC48D}.exe
{8442A961-1374-44b5-875F-0D928052C16F}.exe
{99499375-5397-4483-83F7-5B6186A257D9}.exe
{B40BEE71-5822-4f51-8C4C-5E21025D8BE4}.exe
{CAA02BA5-7AD1-4e60-818F-C720F8D74B5E}.exe
{CFE80D8D-4CA7-4643-9495-053BDE050A7A}.exe
{F3D83AEF-8046-478f-BEF9-397C641A00DE}.exe
{F934803F-083F-4c72-9B0C-877869697C0B}.exe