stormser | 84fcfd5c81385360aaf6b7bc40fae6c96326332ce483c8600ae4282a9063b912

General

Target
2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe
Size 60KB
Sample260813-e4jg9sbk5t
SHA256 84fcfd5c81385360aaf6b7bc40fae6c96326332ce483c8600ae4282a9063b912
MD5 7da326dd9576eb0a1fe6f19c236dde89
SHA1 0037ffd635f8f65142f28ab38d4762c313e4e58d
SHA512 4621912a9cf6a2b4bb0a859b4d591a53ed27e015dcdb31c8bcb35929afd7249d00599e0c965d2f410be98e77e5418a60136063dab832d0e9f9b7d17bba202b34
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroO4/CFsrdHWMZo:vvw9816vhKQLroO4/wQpWMZo
TLSH
T1FD533B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 8 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024478-2.dat	family_stormser
behavioral1/files/0x000800000002446a-7.dat	family_stormser
behavioral1/files/0x000400000001db14-8.dat	family_stormser
behavioral1/files/0x000900000002446a-14.dat	family_stormser
behavioral1/files/0x000300000001da44-18.dat	family_stormser
behavioral1/files/0x0003000000021d93-22.dat	family_stormser
behavioral1/files/0x000500000000002e-26.dat	family_stormser
behavioral1/files/0x0003000000000701-30.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 8 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024478-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000800000002446a-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000400000001db14-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000900000002446a-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001da44-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0003000000021d93-22.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000500000000002e-26.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0003000000000701-30.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56ABBF72-F05A-4097-908F-91D207E3AA69}	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{56ABBF72-F05A-4097-908F-91D207E3AA69}\stubpath = "C:\\Windows\\{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe"	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43222F72-96A7-4e51-9BC8-F373C98EDED5}\stubpath = "C:\\Windows\\{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe"	2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}\stubpath = "C:\\Windows\\{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe"	{421D7253-622A-4e18-9B30-46B91A025C36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{812051F4-9C61-4e8c-92D3-33576EC1F64C}	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}\stubpath = "C:\\Windows\\{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe"	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}\stubpath = "C:\\Windows\\{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe"	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421D7253-622A-4e18-9B30-46B91A025C36}	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{812051F4-9C61-4e8c-92D3-33576EC1F64C}\stubpath = "C:\\Windows\\{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe"	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}\stubpath = "C:\\Windows\\{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe"	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43222F72-96A7-4e51-9BC8-F373C98EDED5}	2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{421D7253-622A-4e18-9B30-46B91A025C36}\stubpath = "C:\\Windows\\{421D7253-622A-4e18-9B30-46B91A025C36}.exe"	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}	{421D7253-622A-4e18-9B30-46B91A025C36}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe

Executes dropped EXE 8 IoCs

pid	Process
1264	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
4520	{421D7253-622A-4e18-9B30-46B91A025C36}.exe
2252	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
1192	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
4032	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
4080	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
884	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe
4724	{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
File created	C:\Windows\{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
File created	C:\Windows\{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
File created	C:\Windows\{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
File created	C:\Windows\{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe
File created	C:\Windows\{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe	2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe
File created	C:\Windows\{421D7253-622A-4e18-9B30-46B91A025C36}.exe	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
File created	C:\Windows\{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe	{421D7253-622A-4e18-9B30-46B91A025C36}.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3016	cmd.exe
3792	cmd.exe
224	cmd.exe
4604	cmd.exe
2920	cmd.exe
4296	cmd.exe
1340	cmd.exe
4676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{421D7253-622A-4e18-9B30-46B91A025C36}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2608	2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	1264	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
Token: SeIncBasePriorityPrivilege	4520	{421D7253-622A-4e18-9B30-46B91A025C36}.exe
Token: SeIncBasePriorityPrivilege	2252	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
Token: SeIncBasePriorityPrivilege	1192	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
Token: SeIncBasePriorityPrivilege	4032	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
Token: SeIncBasePriorityPrivilege	4080	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
Token: SeIncBasePriorityPrivilege	884	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1264	2608	2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe	93
PID 2608 wrote to memory of 1340	2608	2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe	94
PID 1264 wrote to memory of 4520	1264	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe	95
PID 1264 wrote to memory of 4676	1264	{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe	96
PID 4520 wrote to memory of 2252	4520	{421D7253-622A-4e18-9B30-46B91A025C36}.exe	98
PID 4520 wrote to memory of 3016	4520	{421D7253-622A-4e18-9B30-46B91A025C36}.exe	99
PID 2252 wrote to memory of 1192	2252	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe	100
PID 2252 wrote to memory of 3792	2252	{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe	101
PID 1192 wrote to memory of 4032	1192	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe	102
PID 1192 wrote to memory of 224	1192	{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe	103
PID 4032 wrote to memory of 4080	4032	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe	105
PID 4032 wrote to memory of 4604	4032	{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe	106
PID 4080 wrote to memory of 884	4080	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe	107
PID 4080 wrote to memory of 2920	4080	{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe	108
PID 884 wrote to memory of 4724	884	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe	109
PID 884 wrote to memory of 4296	884	{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_7da326dd9576eb0a1fe6f19c236dde89_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
  C:\Windows\{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\{421D7253-622A-4e18-9B30-46B91A025C36}.exe
    C:\Windows\{421D7253-622A-4e18-9B30-46B91A025C36}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
      C:\Windows\{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
        
        C:\Windows\{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1192
      - C:\Windows\{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
        
        C:\Windows\{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4032
        
        C:\Windows\{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
        
        C:\Windows\{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4080
        
        C:\Windows\{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe
        
        C:\Windows\{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe
        
        C:\Windows\{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4724
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{56ABB~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{9E530~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0527B~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4604
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{81205~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:224
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45032~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{421D7~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{43222~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe

Path C:\Windows\{0527BFBF-57A4-45e7-AD0E-FC3ECFAFE4DD}.exe
Size 60KB
SHA256 25df93faff8e30395c6e136f2371852f69102ca3e7851cae315be9fcfb273cdb
MD5 a43007f37a0eb6cac0b92dc509128837
SHA1 7c16ee5942dba86e8449e4098ba2bf4f6cb51a79
SHA512 ec122402f6e5c73e063902db823d501421651697f09ed9dcd62bc621350cd1f0ea65ac586daa0d8e48dd99999cab2c1c35275a4ed01db2f2c8eec3ac649866de
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroB4/CFsrdHWMZo:vvw9816vhKQLroB4/wQpWMZo
TLSH
T122533B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe

Path C:\Windows\{32D03DF3-F61B-4b9e-A5C4-2292F7C12AC8}.exe
Size 60KB
SHA256 8b269cc332cf5ceaf0860a64a18d6e29b7fac538447ffbba95be1ca47b399f50
MD5 1131573aca02eea8e6f0fa5ea35a5d01
SHA1 e51b44cf2568b9c6349dc4de807dbc87be5376d8
SHA512 350651bf0672d2099c791c982dfc09ca315e8587b24374e822ecccc83c1204adff162328cf59b6578387bda259e35031d7981a31c537b4040957fd319fa7ff7d
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroM4/CFsrdHWMZo:vvw9816vhKQLroM4/wQpWMZo
TLSH
T13B533B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{421D7253-622A-4e18-9B30-46B91A025C36}.exe

Path C:\Windows\{421D7253-622A-4e18-9B30-46B91A025C36}.exe
Size 60KB
SHA256 e9d1c48aeeeded850fb7dacbef19a3412be90b33c48b1d83f76d2599877a7b33
MD5 cd400ee4ed870ef1a55d545c17de981e
SHA1 08d148b52a761ee1ce3e759757bdc0984fd3db05
SHA512 dcd5e8c9c5ed089397f67398f76da08da84a028bdb7a263bfcf145b37f8a335e963dc1eb1251c4bd5f32ad171629f4f965963a241ae7484e7940228bc4644d13
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroI4/CFsrdHWMZo:vvw9816vhKQLroI4/wQpWMZo
TLSH
T1C3534B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe

Path C:\Windows\{43222F72-96A7-4e51-9BC8-F373C98EDED5}.exe
Size 60KB
SHA256 ac395336a871f9579ac383c93233e4fc9bcff967c4d90fc5bc6cc053c6b455c7
MD5 5b81591e8639d17551e183050dc4eecd
SHA1 61fa7839c2ea601ffcdb5537bc2e09d296c1d692
SHA512 15f3bf746a07121cb8a5cdf7eaf37ab36c515028e549873eb20d1e801d9af79626273cf884fbf375d5bafa00d89a093f9f8259530280d08b152ea140c94a0d97
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrol4/CFsrdHWMZo:vvw9816vhKQLrol4/wQpWMZo
TLSH
T127534B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe

Path C:\Windows\{4503270D-7DF8-40d2-AA28-FFE3B9A865D6}.exe
Size 60KB
SHA256 4e3b021eeeac2e17ae52cc3d915adc0ee7c097ea075594f3b85eaffc9e5aadb0
MD5 ff3d0435c84012d19bc49c18b7546d9a
SHA1 e6e2efd7c68ba1457c34c67d32a45be3026cf11b
SHA512 9ffa45d77a049a6827157f910e399ac19421ad2908491a7cda676dd49a024520bc6e89fdb1c3c6dcd6961dc20769d481fca27008f12200cdb8296dcf27f9f6a1
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro+4/CFsrdHWMZo:vvw9816vhKQLro+4/wQpWMZo
TLSH
T1B3534B830F997CF2FB810175043A8BB992AB59D4D15FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe

Path C:\Windows\{56ABBF72-F05A-4097-908F-91D207E3AA69}.exe
Size 60KB
SHA256 5d260c8269b054c2e242dc65941d0839bbc1ca5c7d8bb51eb67862cf70053d8c
MD5 bcfc9726d545a535ba6541c802782c61
SHA1 153c8a5699df246a91f5d1a44d909cf07c7820c4
SHA512 a2eda16bde1cff31411bf61edf5aa60aa912d0b8127280f08b773026c0b5480327e14b979bb27234c2f9a88e33823397c4795a3269cd3c7b3d076b1f46674217
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro6O4/CFsrdHWMZo:vvw9816vhKQLroJ4/wQpWMZo
TLSH
T1EB533B830F997CF2FB810175047A8B7992AB59D4D14FFE9BBF90CC194436691E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe

Path C:\Windows\{812051F4-9C61-4e8c-92D3-33576EC1F64C}.exe
Size 60KB
SHA256 6c8b09540606a399bc6715678da0702a3d9dce0b0e66323646832dd13d79ac37
MD5 621136a3043e26b2008ab18a61c2092d
SHA1 8468a1c20cb44c339b36f7029d706385b90fc2cb
SHA512 f8410e3f185867951ba7f202ca7e9f1e85baf17e941681962c60a96aa5a4831fe6d4cbcae071517174af608bbd8907d63030c4b2c7376b0551f8123696800227
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro74/CFsrdHWMZo:vvw9816vhKQLro74/wQpWMZo
TLSH
T1B6534B830F997CF2FB810175043A8BB996AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe

Path C:\Windows\{9E530E6B-C045-48e1-BEAD-2CA8B82E1F1C}.exe
Size 60KB
SHA256 c8e61d21df76abc92522f596f619e810030e1bd9101b5365a53cab48b7c97d6f
MD5 33beb2640a5362f9addef214d82e8eaa
SHA1 73efcddf883b2eaefa21e423086d266d638635c1
SHA512 72c870ba925b70e0f739d24d5fa890dcf7c82bfcb79945d6dbcac79694579e531d6ae2b758ae260347f104c3859c3bd9a841460a5c8539f06a28ce2b71df26dc
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroM4/CFsrdHWMZo:vvw9816vhKQLroM4/wQpWMZo
TLSH
T1D6534B830F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads