stormser | 8958a0eafca627c43f4121a272a75c47d4720422a1427a79ca116cdc927f1d8a

General

Target
2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe
Size 59KB
Sample260801-1bpdpsgn41
SHA256 8958a0eafca627c43f4121a272a75c47d4720422a1427a79ca116cdc927f1d8a
MD5 47606cffd837df3f2f52601fa8f9176b
SHA1 86b80bd5fa1733539cd035aacb411438c824cc40
SHA512 104a3c8996e19ecbe8504fe7f29ebe369e62dd68e4e2e17ac6b6d1e61f3c691e6918b05c2114223a186ab895e3e20a1d71248f40c5d82e4c0da406155540c823
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroomaQ04/CFsrFJGlMlrWg:Mvw9816vhKQLroLaQ04/wQTGaW
TLSH
T19F436C835BDA2CF2F3E1123205B846B5D22B9AD8911DBEDBBB90DE0504372D1D53E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024496-2.dat	family_stormser
behavioral1/files/0x00070000000244a4-6.dat	family_stormser
behavioral1/files/0x000400000001da8c-10.dat	family_stormser
behavioral1/files/0x00080000000244a4-14.dat	family_stormser
behavioral1/files/0x00050000000006d1-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0467F60-BA9D-4670-9627-BBE28ABF56CD}	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECE12BB6-30D4-451c-B370-663F25744F4B}	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}\stubpath = "C:\\Windows\\{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe"	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDF37C61-0D28-4b43-A313-AB548C425AD4}\stubpath = "C:\\Windows\\{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe"	2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0467F60-BA9D-4670-9627-BBE28ABF56CD}\stubpath = "C:\\Windows\\{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe"	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ECE12BB6-30D4-451c-B370-663F25744F4B}\stubpath = "C:\\Windows\\{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe"	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDF37C61-0D28-4b43-A313-AB548C425AD4}	2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}\stubpath = "C:\\Windows\\{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe"	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe

Executes dropped EXE 5 IoCs

pid	Process
3936	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
5008	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
3216	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
1832	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
2212	{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
File created	C:\Windows\{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe	2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe
File created	C:\Windows\{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
File created	C:\Windows\{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
File created	C:\Windows\{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1780	cmd.exe
3564	cmd.exe
2172	cmd.exe
2160	cmd.exe
4780	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2272	2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3936	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
Token: SeIncBasePriorityPrivilege	5008	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
Token: SeIncBasePriorityPrivilege	3216	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
Token: SeIncBasePriorityPrivilege	1832	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3936	2272	2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe	87
PID 2272 wrote to memory of 4780	2272	2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe	88
PID 3936 wrote to memory of 5008	3936	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe	94
PID 3936 wrote to memory of 1780	3936	{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe	95
PID 5008 wrote to memory of 3216	5008	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe	97
PID 5008 wrote to memory of 3564	5008	{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe	98
PID 3216 wrote to memory of 1832	3216	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe	99
PID 3216 wrote to memory of 2172	3216	{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe	100
PID 1832 wrote to memory of 2212	1832	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe	101
PID 1832 wrote to memory of 2160	1832	{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_47606cffd837df3f2f52601fa8f9176b_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
  C:\Windows\{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
    C:\Windows\{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
      C:\Windows\{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3216
    - - C:\Windows\{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
        
        C:\Windows\{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1832
      - C:\Windows\{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe
        
        C:\Windows\{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2212
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ECE12~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2160
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0467~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2172
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B79F4~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FDF37~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1780
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe

Path C:\Windows\{B79F4CBE-0929-44a2-9BC3-17FB547FCC41}.exe
Size 59KB
SHA256 29aa69e70a642d00622f1b6a8102e8ec97c9004e26fe5bf041798554c45d98a0
MD5 956ea6c4bb11bcb727f1f976f035152a
SHA1 fb2da8932c08ed20d51875b931cdaea73475b3dc
SHA512 7582f2a62ee8d82f3459df02d3e428c2825ff3059fe2f226ad973ab5a3c6abd722883326f397c2f102a4e80a90cfdbaf7cad615a3d0bbfe3b128e28085ffe9de
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroomaQu4/CFsrFJGlMlrWg:Mvw9816vhKQLroLaQu4/wQTGaW
TLSH
T1B8436B835BEA1CF2F3E1123205B846B5D22B9AD8911DBEDBBB90DE1500372D1D53E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe

Path C:\Windows\{C2BC452A-1FE5-4f34-A6B3-3B4549AFF735}.exe
Size 59KB
SHA256 ae224035e3ea5a64777058640e7e07d5d2a3364db4896e48118247b0bb6ca2c7
MD5 39ce1c0622c3c163182f970c07898b03
SHA1 ce8e2afe270410c07f3b646b7e368be197ee9bd0
SHA512 adcef9bfad1d182f27b400c20a509dd8776dbcebc2ec70a2845acb5ab6739ce6a2c0fd4fc36b9174b2cdddda44c8165f7daf298c47e5f2a59323c586145c89c3
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroomaQW4/CFsrFJGlMlrWg:Mvw9816vhKQLroLaQW4/wQTGaW
TLSH
T1B1436C835BDA1CF2F3E1123205B846B5D22B9AD8911DBEDBBB90DE0504372D1D53E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe

Path C:\Windows\{E0467F60-BA9D-4670-9627-BBE28ABF56CD}.exe
Size 59KB
SHA256 d832fb8a6210f2312ba55899c333c8e388a1a97a1fa55b43da7c463569aacecd
MD5 5179298304e491ef47a793a9c9e33517
SHA1 5b04819be8825fc67bf191fd32bc584e071b421b
SHA512 f6633ff4bc7114c46edfa794eab8bf2e66043f3e8f37297961599cd2cb778670732b7e31ea5c802fe579bb2bbb5d865e25968ba3e7f211eaf6be71f1cb4b8224
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroomaQk4/CFsrFJGlMlrWg:Mvw9816vhKQLroLaQk4/wQTGaW
TLSH
T131436B835BEA1CF2F2E1123605B846B5D22B9AD4911DBEDBBB90DE0904372D1D53E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe

Path C:\Windows\{ECE12BB6-30D4-451c-B370-663F25744F4B}.exe
Size 59KB
SHA256 52dd07273bda903f1e9715e32f78a2ea0c4f3974f254d1a2ac17b6dc5933315c
MD5 36ca1deee4d883c73c4d85cab1979258
SHA1 245c35773a3b8f9331a5f2583e3383ce036efcb9
SHA512 09e6b51f55e685d4a01bcc4edef8292a45a78655ce97856ba2297dd32e86bacf53328a2c8a5e29b41978f612ca828fafa5dcd9496cec3756584367369dbf81ec
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroomaQG4/CFsrFJGlMlrWg:Mvw9816vhKQLroLaQG4/wQTGaW
TLSH
T11A436B835BDA1CF2F3E1123205B846B5D22B9AD4911DBEDBBB90DE0504372D1D53F14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe

Path C:\Windows\{FDF37C61-0D28-4b43-A313-AB548C425AD4}.exe
Size 59KB
SHA256 96ee154fcfa53be4feb7c3d03aae07cb0e2cff3f7b8dd6725d729d2315e23880
MD5 33f690b2af0c69697bd9dc649de6aa93
SHA1 36c0824f6f034f1345c5ab6608f1a73a4faf9db7
SHA512 52266dca6fc02946a9e9e1a3255bba7123cfc61478d14cf8a7294dbc3da611bd5e9a24c4dcdc903149e7c2a4d987916ea149ee4cfcae9391df70bbd11030002e
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroomaQP4/CFsrFJGlMlrWg:Mvw9816vhKQLroLaQP4/wQTGaW
TLSH
T11B436B835BEA2CF2F3E1123205B846B5D22B9AD8911DBEDBBB90DE0500372D1D53F14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads