stormser | 0987d7638afea2460d54b67490ed6c7a39e7f9497223e7aa33806e8892b33bce

General

Target
2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe
Size 168KB
Sample260810-1fnb7saj21
SHA256 0987d7638afea2460d54b67490ed6c7a39e7f9497223e7aa33806e8892b33bce
MD5 e3c182f86b6fbc4c7fcb8dd9d6280ade
SHA1 7e90807a3065a9fe9121fa03ba787cdc1e8cb095
SHA512 2832ad54087ded21109bbd10b984292db55389834dcd6b0a128e614b5501a82ba3ad300da67f04dc8634fab6ebb5ea5a51f96b4505d5cc0f901d33d7b59c2ffb
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw54/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro54/CFsrd
TLSH
T127F319834BDE58F3F781113008798AB9927B9AD4961EBEEF7F90CD250077252D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000024552-2.dat	family_stormser
behavioral1/files/0x0008000000024553-6.dat	family_stormser
behavioral1/files/0x0007000000024559-8.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54EEBD34-B7C3-45be-A159-89E4C2D4A640}\stubpath = "C:\\Windows\\{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe"	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F434FDCB-2376-42fd-9955-07531EA612A7}	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F434FDCB-2376-42fd-9955-07531EA612A7}\stubpath = "C:\\Windows\\{F434FDCB-2376-42fd-9955-07531EA612A7}.exe"	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{476D5647-4353-47b0-B3BE-69D186E4B533}	2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{476D5647-4353-47b0-B3BE-69D186E4B533}\stubpath = "C:\\Windows\\{476D5647-4353-47b0-B3BE-69D186E4B533}.exe"	2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54EEBD34-B7C3-45be-A159-89E4C2D4A640}	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe

Executes dropped EXE 3 IoCs

pid	Process
2344	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
1552	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe
3332	{F434FDCB-2376-42fd-9955-07531EA612A7}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{476D5647-4353-47b0-B3BE-69D186E4B533}.exe	2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe
File created	C:\Windows\{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
File created	C:\Windows\{F434FDCB-2376-42fd-9955-07531EA612A7}.exe	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2804	cmd.exe
2864	cmd.exe
2776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F434FDCB-2376-42fd-9955-07531EA612A7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1400	2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2344	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
Token: SeIncBasePriorityPrivilege	1552	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 2344	1400	2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe	87
PID 1400 wrote to memory of 2804	1400	2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe	88
PID 2344 wrote to memory of 1552	2344	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe	89
PID 2344 wrote to memory of 2864	2344	{476D5647-4353-47b0-B3BE-69D186E4B533}.exe	90
PID 1552 wrote to memory of 3332	1552	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe	93
PID 1552 wrote to memory of 2776	1552	{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e3c182f86b6fbc4c7fcb8dd9d6280ade_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
  C:\Windows\{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe
    C:\Windows\{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\{F434FDCB-2376-42fd-9955-07531EA612A7}.exe
      C:\Windows\{F434FDCB-2376-42fd-9955-07531EA612A7}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{54EEB~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{476D5~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{476D5647-4353-47b0-B3BE-69D186E4B533}.exe

Path C:\Windows\{476D5647-4353-47b0-B3BE-69D186E4B533}.exe
Size 168KB
SHA256 23cd2b1471ffff159927c3b954856a9032ff707501476b56cdb12fcd2cad69f1
MD5 5b7353ddb0163f00a6be0fe4cd518ebe
SHA1 ad88206acc473d9e7b615e235b5086417f7f6dfc
SHA512 9759d381c845cd105319a4f35513bfd6c77b8b45174845ec3fb8596dccb709bdfa84505dc435d49e1d4393dd7aa2eeb5ede9195130ff5629c4b4754600a4e9c7
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwc4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroc4/CFsrd
TLSH
T104F319834BDE58F3FB81113008798AB9927B9AD4961EBEEF7F90CD250077252D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe

Path C:\Windows\{54EEBD34-B7C3-45be-A159-89E4C2D4A640}.exe
Size 168KB
SHA256 fcb7cca180d6b8079a1a3de65e8084e52614d25fd5faddc0a5ad450a06aafecc
MD5 d16a4a29406201d98256ec5921b36584
SHA1 f97622b8f4c4af029ba16593fd2c0ee1eafcee81
SHA512 d14a8f33b186639ff429e92e713ee9908e239cdea0221bca6f29a22f528721a8faf83d87b1f338f73dbc9e256bd875367c9522d596c1480c26a48b8ee523ac3d
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwy4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroy4/CFsrd
TLSH
T1BBF319834BDE58F3F781113008798AB9927B9AD4961EBEEF7F90CD250077252D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F434FDCB-2376-42fd-9955-07531EA612A7}.exe

Path C:\Windows\{F434FDCB-2376-42fd-9955-07531EA612A7}.exe
Size 168KB
SHA256 9c2a532220da0d1820c1231733637e772adbabb36d8344eec33bbeefe9b21a72
MD5 9d435432eb96876c85d9e2184951ff23
SHA1 86745f1873f59cfb8c1f63185e6a5af195b19848
SHA512 2071f61109c4a5e6771706f597fe4ab7e7acecb590d896ef5aed437733048297643ae8bc74ce90ff1a07a9632f4a845dd2e9669ade55a8431d6aa4e99351e760
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwu4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrou4/CFsrd
TLSH
T14CF319834BDE58F3FB81113008798AB9927B9AD4921EBEEF7F90CD250077252D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads