Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
05/07/2026, 06:02
General
- Target 2026-07-05_dd0c38c88194a92217b612b1441e5cd9_elex_rincux_wannacry.exe
- Size 64KB
- Sample260705-grsarady8q
- SHA256 67eda3d705eb5518f30f11ca6181daa3ce7cf0c938094ca2a1b2950f7fc421cb
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_dd0c38c88194a92217b612b1441e5cd9_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_dd0c38c88194a92217b612b1441e5cd9_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49C05F23-ED58-47b4-87B1-991027FB88F1}.exeC:\Windows\{49C05F23-ED58-47b4-87B1-991027FB88F1}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5271B86-44A3-459e-BCA3-3B1E43400DF7}.exeC:\Windows\{D5271B86-44A3-459e-BCA3-3B1E43400DF7}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6D1099C-0788-49bf-9979-EF6BA279D905}.exeC:\Windows\{B6D1099C-0788-49bf-9979-EF6BA279D905}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53DB37A2-2AB0-4ced-9A6B-EC5205D6DE03}.exeC:\Windows\{53DB37A2-2AB0-4ced-9A6B-EC5205D6DE03}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{750A8525-6CBE-4f0c-BAD2-08B74EC14311}.exeC:\Windows\{750A8525-6CBE-4f0c-BAD2-08B74EC14311}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D259A57A-B702-46a5-A864-5BA725E18194}.exeC:\Windows\{D259A57A-B702-46a5-A864-5BA725E18194}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{728F5ED1-F93B-4a28-B43E-A9FFDE488872}.exeC:\Windows\{728F5ED1-F93B-4a28-B43E-A9FFDE488872}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFE9B815-551A-44eb-B1F4-6C8A50F2554B}.exeC:\Windows\{EFE9B815-551A-44eb-B1F4-6C8A50F2554B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EF43D50-FD68-4df7-8B66-E72FD6D2D53F}.exeC:\Windows\{4EF43D50-FD68-4df7-8B66-E72FD6D2D53F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECEC54FD-8100-4a8d-AB77-8B8F04941D3A}.exeC:\Windows\{ECEC54FD-8100-4a8d-AB77-8B8F04941D3A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7224EC3-3665-4c35-9B5A-15297EE923D3}.exeC:\Windows\{C7224EC3-3665-4c35-9B5A-15297EE923D3}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECEC5~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EF43~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFE9B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{728F5~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D259A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{750A8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53DB3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6D10~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5271~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49C05~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{49C05F23-ED58-47b4-87B1-991027FB88F1}.exe
{4EF43D50-FD68-4df7-8B66-E72FD6D2D53F}.exe
{53DB37A2-2AB0-4ced-9A6B-EC5205D6DE03}.exe
{728F5ED1-F93B-4a28-B43E-A9FFDE488872}.exe
{750A8525-6CBE-4f0c-BAD2-08B74EC14311}.exe
{B6D1099C-0788-49bf-9979-EF6BA279D905}.exe
{C7224EC3-3665-4c35-9B5A-15297EE923D3}.exe
{D259A57A-B702-46a5-A864-5BA725E18194}.exe
{D5271B86-44A3-459e-BCA3-3B1E43400DF7}.exe
{ECEC54FD-8100-4a8d-AB77-8B8F04941D3A}.exe
{EFE9B815-551A-44eb-B1F4-6C8A50F2554B}.exe
memory/464-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/464-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1436-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1436-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2444-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2444-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2828-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2828-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4112-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4112-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4244-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4740-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4740-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4740-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5516-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5516-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5776-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5776-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6036-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6036-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6728-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6728-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6728-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6928-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6928-57-0x0000000000400000-0x0000000000410000-memory.dmp