Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 03:42
General
- Target 2026-07-22_891e26322ae262396dd46ee1f794ac68_elex_rincux_wannacry.exe
- Size 64KB
- Sample260722-d9fswsac64
- SHA256 008f6ad5827cd9cb7db2cf85f919306321ca1f0c6e8f95bf0bdd9097cce8188a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Detects Windows executables referencing non-Windows User-Agents 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_891e26322ae262396dd46ee1f794ac68_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_891e26322ae262396dd46ee1f794ac68_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B242CE6-C728-4a40-93CA-76A87AE90DB8}.exeC:\Windows\{4B242CE6-C728-4a40-93CA-76A87AE90DB8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{307D2328-2751-4a13-878D-4B960F5D8CAF}.exeC:\Windows\{307D2328-2751-4a13-878D-4B960F5D8CAF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4E3F3CC-8C1C-4b56-9DD5-6EEA13560254}.exeC:\Windows\{A4E3F3CC-8C1C-4b56-9DD5-6EEA13560254}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3CE8B80-77CD-4019-BF90-0B31C33DB669}.exeC:\Windows\{A3CE8B80-77CD-4019-BF90-0B31C33DB669}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5157D488-9CB4-457c-A7FB-79B3266EF830}.exeC:\Windows\{5157D488-9CB4-457c-A7FB-79B3266EF830}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3074EE4D-681E-4e64-9A31-DD43A1B242FF}.exeC:\Windows\{3074EE4D-681E-4e64-9A31-DD43A1B242FF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86449611-1E22-49c2-BB48-198CC3BE9CA5}.exeC:\Windows\{86449611-1E22-49c2-BB48-198CC3BE9CA5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0157B5E6-5B5F-4c4a-8F14-C008AE3C7B39}.exeC:\Windows\{0157B5E6-5B5F-4c4a-8F14-C008AE3C7B39}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93847952-AC15-4752-88CF-792FECA64DA7}.exeC:\Windows\{93847952-AC15-4752-88CF-792FECA64DA7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{45F04777-E7DF-44b2-9FB9-8DC61DDE1E77}.exeC:\Windows\{45F04777-E7DF-44b2-9FB9-8DC61DDE1E77}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06510883-3D24-4311-9CCA-1399AB835265}.exeC:\Windows\{06510883-3D24-4311-9CCA-1399AB835265}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45F04~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93847~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0157B~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86449~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3074E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5157D~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3CE8~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4E3F~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{307D2~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B242~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0157B5E6-5B5F-4c4a-8F14-C008AE3C7B39}.exe
{06510883-3D24-4311-9CCA-1399AB835265}.exe
{3074EE4D-681E-4e64-9A31-DD43A1B242FF}.exe
{307D2328-2751-4a13-878D-4B960F5D8CAF}.exe
{45F04777-E7DF-44b2-9FB9-8DC61DDE1E77}.exe
{4B242CE6-C728-4a40-93CA-76A87AE90DB8}.exe
{5157D488-9CB4-457c-A7FB-79B3266EF830}.exe
{86449611-1E22-49c2-BB48-198CC3BE9CA5}.exe
{93847952-AC15-4752-88CF-792FECA64DA7}.exe
{A3CE8B80-77CD-4019-BF90-0B31C33DB669}.exe
{A4E3F3CC-8C1C-4b56-9DD5-6EEA13560254}.exe
memory/360-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/360-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/360-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1888-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1888-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2088-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2088-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2160-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3020-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3020-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3532-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3532-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3564-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3564-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4084-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4084-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4084-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4088-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4088-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4088-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4844-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4844-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5300-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5300-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5536-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5536-70-0x0000000000400000-0x0000000000410000-memory.dmp