stormser | c5b26d81a2a1c5a218dcabb0ba49d96a9c10e3942791206a0bcc66d50015b229

General

Target
2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe
Size 60KB
Sample260812-lytvdatgnd
SHA256 c5b26d81a2a1c5a218dcabb0ba49d96a9c10e3942791206a0bcc66d50015b229
MD5 686e2029918d978524548f2bc5d95196
SHA1 5027c94fd13313df4906ff10522838b2b630f474
SHA512 cfc6a58376f95a3dcb8ba74e95e99be81ac866dc1ef911b9c7c4c6f62c3c5b8c6af22cf0973bcdb14e52fd3aff0ba5fde68c08a6168c0b9a54146617394b7cd8
SSDEEP 768:dvw9816vhKQLroCF4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:REGh0oCFlwWMZQcpmgDagIyS1loL7Wr
TLSH
T1D6535B02A684B5F2EBAC0134B19F0FBE963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x00080000000243f4-2.dat	family_stormser
behavioral1/files/0x00080000000243f5-6.dat	family_stormser
behavioral1/files/0x00080000000243fc-8.dat	family_stormser
behavioral1/files/0x00070000000243fe-14.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/files/0x00080000000243f4-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00080000000243f5-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00080000000243fc-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00070000000243fe-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C735568-B2EF-4f23-A40F-4B6734DD037B}	2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5C735568-B2EF-4f23-A40F-4B6734DD037B}\stubpath = "C:\\Windows\\{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe"	2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBB431EB-499C-4c59-A301-C24187877FED}	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BBB431EB-499C-4c59-A301-C24187877FED}\stubpath = "C:\\Windows\\{BBB431EB-499C-4c59-A301-C24187877FED}.exe"	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D574B9B8-686B-4b27-AE42-2063BDA0CF21}	{BBB431EB-499C-4c59-A301-C24187877FED}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D574B9B8-686B-4b27-AE42-2063BDA0CF21}\stubpath = "C:\\Windows\\{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe"	{BBB431EB-499C-4c59-A301-C24187877FED}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE68CF19-1572-4c9b-BAB7-BC48794007BF}	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE68CF19-1572-4c9b-BAB7-BC48794007BF}\stubpath = "C:\\Windows\\{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe"	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe

Executes dropped EXE 4 IoCs

pid	Process
4748	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
3180	{BBB431EB-499C-4c59-A301-C24187877FED}.exe
4992	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe
1500	{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe	{BBB431EB-499C-4c59-A301-C24187877FED}.exe
File created	C:\Windows\{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe
File created	C:\Windows\{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe	2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe
File created	C:\Windows\{BBB431EB-499C-4c59-A301-C24187877FED}.exe	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1216	cmd.exe
4452	cmd.exe
4012	cmd.exe
4608	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BBB431EB-499C-4c59-A301-C24187877FED}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5056	2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe
Token: SeIncBasePriorityPrivilege	4748	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
Token: SeIncBasePriorityPrivilege	3180	{BBB431EB-499C-4c59-A301-C24187877FED}.exe
Token: SeIncBasePriorityPrivilege	4992	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4748	5056	2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe	86
PID 5056 wrote to memory of 4452	5056	2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe	87
PID 4748 wrote to memory of 3180	4748	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe	88
PID 4748 wrote to memory of 4012	4748	{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe	89
PID 3180 wrote to memory of 4992	3180	{BBB431EB-499C-4c59-A301-C24187877FED}.exe	93
PID 3180 wrote to memory of 4608	3180	{BBB431EB-499C-4c59-A301-C24187877FED}.exe	94
PID 4992 wrote to memory of 1500	4992	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe	95
PID 4992 wrote to memory of 1216	4992	{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_686e2029918d978524548f2bc5d95196_elex_remcos_rincux_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
  C:\Windows\{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\{BBB431EB-499C-4c59-A301-C24187877FED}.exe
    C:\Windows\{BBB431EB-499C-4c59-A301-C24187877FED}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3180
  - - C:\Windows\{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe
      C:\Windows\{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe
        
        C:\Windows\{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1500
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D574B~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1216
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{BBB43~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{5C735~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe

Path C:\Windows\{5C735568-B2EF-4f23-A40F-4B6734DD037B}.exe
Size 60KB
SHA256 c1097d146224ea1eb59124ae0547d90e1e5afe7279686dc292574f366e5ffc69
MD5 0b850bae019bbe36680069181935416b
SHA1 0adf52d1ff560bab4fbba815bc3dfd4f93a2578b
SHA512 dbfb7b3a11262638ed0825f0374e9db9e2f4578f44e3d4f23136379032059ad7537cb970c4972cc8869ad885a4e65cbb2fdd7b8231dd94ea91fc44d2f33487c3
SSDEEP 768:dvw9816vhKQLroCA4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:REGh0oCAlwWMZQcpmgDagIyS1loL7Wr
TLSH
T173535B02A684B5F2EBAC0134B19F0FBE963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BBB431EB-499C-4c59-A301-C24187877FED}.exe

Path C:\Windows\{BBB431EB-499C-4c59-A301-C24187877FED}.exe
Size 60KB
SHA256 fb8d3b86e8bbe5b5dd6951900513054ff732a90616cdfa6e36612b95e5528891
MD5 7aed77e0e4891ded924ffe57d7a38f6e
SHA1 f4218a282d3769642567cfb267dd9e4290fc52ae
SHA512 44a26828725b0abdd1fda802edad1842509c1355237c45c3f131a1b91d9f384b102671b1669c9f57356ebe6de0cb10513fe0ad9433e368461043cd5a55339f6a
SSDEEP 768:dvw9816vhKQLroCf4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:REGh0oCflwWMZQcpmgDagIyS1loL7Wr
TLSH
T167535B02A684B5F2EBAC0134B19F0FBE963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe

Path C:\Windows\{D574B9B8-686B-4b27-AE42-2063BDA0CF21}.exe
Size 60KB
SHA256 70ed444d8f0971cb4384401dd005f465f03607a975af4ee50c83ac72f407feaa
MD5 5ac66f90fe36f329cd35aff6a1be4673
SHA1 301700945a4a6cecff3ee5bc6620e5fae95c94c2
SHA512 198f599a6f7e21644ebbebc7a9390e611baa344d2a26f57797a6490a7ee3868eb76c3d0cfa856353111465774356ee7adf2b0f7ce86162db4d2185748b248dcd
SSDEEP 768:dvw9816vhKQLroCt4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:REGh0oCtlwWMZQcpmgDagIyS1loL7Wr
TLSH
T140535B02A684B5F2EBAC0134B19F0FBE963795B1C0D9682F6F634DA55462C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe

Path C:\Windows\{DE68CF19-1572-4c9b-BAB7-BC48794007BF}.exe
Size 60KB
SHA256 fbcbfdd12afc262b24359df3e3984a6168db1bb99a4fd99d24f369c13dad80f6
MD5 9de54b4b1269bde26bc169a08e3d1093
SHA1 e4b903b109ff24a086ab71fd56ce26536a8de0ea
SHA512 086b6bd8df0509f56bf35d40b0d6f41739ee4c2d396c45549656e775b8fb1ef56c0c23d2940c74ef6296caa537d0ecc2ea881b21e3aac0adb17eb92f05628a45
SSDEEP 768:dvw9816vhKQLroC84/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:REGh0oC8lwWMZQcpmgDagIyS1loL7Wr
TLSH
T1A4535B02A684B5F2EBAC0134B19F0FBE963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads