stormser | c3ffdca086cc5b7799e1359a3029254a5ea40fc264bf02753c64f910abdbfd25

General

Target
2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe
Size 161KB
Sample260728-vw67csswdt
SHA256 c3ffdca086cc5b7799e1359a3029254a5ea40fc264bf02753c64f910abdbfd25
MD5 534f7a7b4c5c696ef53cc7914a271e37
SHA1 ca3b6d91dc8d7c05535706b5b3b9b56376084a4c
SHA512 6b18a9feb702f702eb694e14723f5754dcdb1534ea8542a8c73a875c5837ff2764ac800a1487f6a6beb71dacf21a1ca1139f06645b43e12434fbca89c448ee65
SSDEEP 1536:YEGh0oml2unMxVS3HgCevo4n9dbH6gSqYGG3A7hgQO17If1YqQzz0anaapm:YEGh0omlvMUcH3egXGQ01bqipnTm
TLSH
T131F32839ADC70177D17681B485F126A7FF79B9A334199E0E879247024C22B12BD9FC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x00070000000242c8-2.dat	family_stormser
behavioral1/files/0x000f0000000242c9-6.dat	family_stormser
behavioral1/files/0x00080000000242d2-11.dat	family_stormser
behavioral1/files/0x00100000000242c9-14.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B70E04A-7354-4037-ABF4-B820B4C6B205}\stubpath = "C:\\Windows\\{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe"	2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}\stubpath = "C:\\Windows\\{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe"	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1612F27-257C-42fd-9123-BFB3CD7C843D}	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1612F27-257C-42fd-9123-BFB3CD7C843D}\stubpath = "C:\\Windows\\{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe"	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}\stubpath = "C:\\Windows\\{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe"	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9B70E04A-7354-4037-ABF4-B820B4C6B205}	2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe

Executes dropped EXE 4 IoCs

pid	Process
3984	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
3852	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
2116	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe
4512	{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe	2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe
File created	C:\Windows\{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
File created	C:\Windows\{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
File created	C:\Windows\{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3976	cmd.exe
3432	cmd.exe
2352	cmd.exe
1284	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2884	2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe
Token: SeIncBasePriorityPrivilege	3984	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
Token: SeIncBasePriorityPrivilege	3852	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
Token: SeIncBasePriorityPrivilege	2116	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 3984	2884	2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe	95
PID 2884 wrote to memory of 3976	2884	2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe	96
PID 3984 wrote to memory of 3852	3984	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe	97
PID 3984 wrote to memory of 3432	3984	{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe	98
PID 3852 wrote to memory of 2116	3852	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe	102
PID 3852 wrote to memory of 2352	3852	{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe	103
PID 2116 wrote to memory of 4512	2116	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe	104
PID 2116 wrote to memory of 1284	2116	{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_534f7a7b4c5c696ef53cc7914a271e37_elex_rhadamanthys_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
  C:\Windows\{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
    C:\Windows\{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Windows\{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe
      C:\Windows\{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2116
    - - C:\Windows\{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe
        
        C:\Windows\{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4512
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B1612~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1284
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{6D80A~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9B70E~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe

Path C:\Windows\{26D60F12-CE4D-4f00-80C3-DA8263CAC48F}.exe
Size 161KB
SHA256 1d0b33948a51cae2a57338c0d1f08f247f8cb3bdf33701e0189d48aceb3577fb
MD5 8bb48ab26c60ca01ae6335d2922714a2
SHA1 5b76a96d70fe5802b820f6ff054b10dd8adb6337
SHA512 4093860ba1d5a0124637e79e6825df29145210823bb7122c3c310733e34204e858cdb8932b93a5fa209731be2d5c480b0653bcc0f4d23b979caa67196b43e9ff
SSDEEP 1536:YEGh0oSl2unMxVS3HgCevo4n9dbH6gSqYGG3A7hgQO17If1YqQzz0anaapm:YEGh0oSlvMUcH3egXGQ01bqipnTm
TLSH
T19EF32839ADC70177D17681B485F126A7FF79B9A334199E0E879247024C22B12BD9FC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe

Path C:\Windows\{6D80A4BE-8E4B-47bd-BF3C-5D8C1E62619E}.exe
Size 161KB
SHA256 2503f537e866d66f831afa5c1585f49a3f5d98818c02ffd4a303e28e5575892b
MD5 05e6c25e9b34f52b0941f91a2f5b8309
SHA1 bf99d4d8e7ae054b720fc8ca77dc25ab6443925a
SHA512 ae5198b3faf011344d6183b992d866e851830de471db130104c44ee0e738e649e9314d0fa92c80c556066edd5d33168ceecb6c8855b49149fec08f546a4c3045
SSDEEP 1536:YEGh0oJl2unMxVS3HgCevo4n9dbH6gSqYGG3A7hgQO17If1YqQzz0anaapm:YEGh0oJlvMUcH3egXGQ01bqipnTm
TLSH
T1B5F32839ADC70177D17681B485F126A7FF69B9A334199E0E879247024C22B12BD9FC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe

Path C:\Windows\{9B70E04A-7354-4037-ABF4-B820B4C6B205}.exe
Size 161KB
SHA256 ae5623babffb9608672dc71e734327768537c539775b112effb89ac5822c7bc1
MD5 013e1625e4c94432fa16cf1b2b5712e2
SHA1 6035ec138b05b86334ac76463a49a51cdfd49443
SHA512 c8bc0d430fe5e57af72d7ac2b8b5a528119b455859fc9c7ed19b6834a0fceb19dfa3deaf715c9806a8188097756c240e9440629aece8e092284233158298cb4a
SSDEEP 1536:YEGh0oYl2unMxVS3HgCevo4n9dbH6gSqYGG3A7hgQO17If1YqQzz0anaapm:YEGh0oYlvMUcH3egXGQ01bqipnTm
TLSH
T1EFF32839ADC60177D17681B485F126A7FF69B9A334199E0E879247024C22B12BD9FC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe

Path C:\Windows\{B1612F27-257C-42fd-9123-BFB3CD7C843D}.exe
Size 161KB
SHA256 f08b007d75838669786a4fb10fc5fc33cb185e585e317a41eb8abed91b1e8111
MD5 9b947d2dd63d5583ab63ff6afbf41e7f
SHA1 edaa757e8499778dbe15f81c013c481269dd53b5
SHA512 b77038bc18a117f8d6998c2940f02383e8bc98ac76f0092b8121023cf13317c8697ea655ae6d6d91abab0af2b784552dcabacfeaffd9e999b7cf9db01b52b95f
SSDEEP 1536:YEGh0oql2unMxVS3HgCevo4n9dbH6gSqYGG3A7hgQO17If1YqQzz0anaapm:YEGh0oqlvMUcH3egXGQ01bqipnTm
TLSH
T104F3283DADC70177D27681B485F126A7FF69B9A334199E0E879247024C22B12BD9FC1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads