Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 03:50
General
- Target 2026-07-30_21d8c7aa602daedc4be9e2b1ce284817_elex_rincux_wannacry.exe
- Size 64KB
- Sample260730-edyt9sbc93
- SHA256 16c926c96fb8da6d91ee6154022c936d2dd1e2281d8268a278d2fc7abec6ca95
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 36 IoCs
- Detects Windows executables referencing non-Windows User-Agents 36 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_21d8c7aa602daedc4be9e2b1ce284817_elex_rincux_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_21d8c7aa602daedc4be9e2b1ce284817_elex_rincux_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{810462DD-F934-42c9-BAA6-EDF9BD16B1FE}.exeC:\Windows\{810462DD-F934-42c9-BAA6-EDF9BD16B1FE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36F17ADE-560E-4379-80EF-67DE40BD261F}.exeC:\Windows\{36F17ADE-560E-4379-80EF-67DE40BD261F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{766C72BB-1442-4428-823F-E0CCBD538BEC}.exeC:\Windows\{766C72BB-1442-4428-823F-E0CCBD538BEC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FCF5BC53-E1DA-4e93-B917-F65D670D90A5}.exeC:\Windows\{FCF5BC53-E1DA-4e93-B917-F65D670D90A5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A438C90-4389-49c3-A998-5DC410F3DA16}.exeC:\Windows\{1A438C90-4389-49c3-A998-5DC410F3DA16}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBE61ECC-1BC5-4cb3-BE52-1F63CD961152}.exeC:\Windows\{CBE61ECC-1BC5-4cb3-BE52-1F63CD961152}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67BA093B-8B16-4ab4-A172-B5FE5C1A1AB0}.exeC:\Windows\{67BA093B-8B16-4ab4-A172-B5FE5C1A1AB0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB98E4D4-4080-4859-B900-7A7B0CF049D5}.exeC:\Windows\{EB98E4D4-4080-4859-B900-7A7B0CF049D5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79EE2FB7-D4C9-4c83-A2CA-DD7EC3AE6AB7}.exeC:\Windows\{79EE2FB7-D4C9-4c83-A2CA-DD7EC3AE6AB7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC3B1623-13BC-4e1b-A7F2-02466F5077B4}.exeC:\Windows\{DC3B1623-13BC-4e1b-A7F2-02466F5077B4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B617D671-7C17-4bba-A055-26BAEC97AD41}.exeC:\Windows\{B617D671-7C17-4bba-A055-26BAEC97AD41}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC3B1~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79EE2~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB98E~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67BA0~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBE61~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A438~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCF5B~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{766C7~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36F17~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81046~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1A438C90-4389-49c3-A998-5DC410F3DA16}.exe
{36F17ADE-560E-4379-80EF-67DE40BD261F}.exe
{67BA093B-8B16-4ab4-A172-B5FE5C1A1AB0}.exe
{766C72BB-1442-4428-823F-E0CCBD538BEC}.exe
{79EE2FB7-D4C9-4c83-A2CA-DD7EC3AE6AB7}.exe
{810462DD-F934-42c9-BAA6-EDF9BD16B1FE}.exe
{B617D671-7C17-4bba-A055-26BAEC97AD41}.exe
{CBE61ECC-1BC5-4cb3-BE52-1F63CD961152}.exe
{DC3B1623-13BC-4e1b-A7F2-02466F5077B4}.exe
{EB98E4D4-4080-4859-B900-7A7B0CF049D5}.exe
{FCF5BC53-E1DA-4e93-B917-F65D670D90A5}.exe
memory/268-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/268-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/268-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1776-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1776-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2232-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2232-78-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2404-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2404-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2460-21-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2460-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2496-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2496-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3432-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4372-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4372-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4372-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4392-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4392-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4628-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4628-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4964-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4964-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5980-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5980-55-0x0000000000400000-0x0000000000410000-memory.dmp