stormser | c0ffa27373a7c6bbea7ada153c029bdba767b9d9c63e3d223f3034d056c5c14d

General

Target
2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe
Size 79KB
Sample260816-wkztkstemb
SHA256 c0ffa27373a7c6bbea7ada153c029bdba767b9d9c63e3d223f3034d056c5c14d
MD5 586367bddf4d1c5b840c78e941422a75
SHA1 50bdedeb678ad859d2e8857a35d96ff140425ccd
SHA512 0dcb5bafede1747d9057b63a57ec4e2b823aaed3e8588f3ff3beb6a11b2b9fc17d35bba63c8deba97303c2e712b7b53661d86284c9187ace99f10682bac25068
SSDEEP 768:4vw9816vhKQLroq4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oqloWMZ3izbR9Xwzz
TLSH
T1A7834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000500000000002e-2.dat	family_stormser
behavioral1/files/0x000400000001e0ed-7.dat	family_stormser
behavioral1/files/0x000400000002381d-10.dat	family_stormser
behavioral1/files/0x004b000000023833-15.dat	family_stormser
behavioral1/files/0x000700000001e691-18.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral1/files/0x000500000000002e-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000400000001e0ed-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000400000002381d-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x004b000000023833-15.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000700000001e691-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}\stubpath = "C:\\Windows\\{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe"	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}\stubpath = "C:\\Windows\\{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe"	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D312F31B-FED1-4e61-8137-AA7F5D0628F4}	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}	2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C39348E4-5B42-494a-95DE-3365212D2C97}	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C39348E4-5B42-494a-95DE-3365212D2C97}\stubpath = "C:\\Windows\\{C39348E4-5B42-494a-95DE-3365212D2C97}.exe"	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D312F31B-FED1-4e61-8137-AA7F5D0628F4}\stubpath = "C:\\Windows\\{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe"	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}\stubpath = "C:\\Windows\\{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe"	2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe

Executes dropped EXE 5 IoCs

pid	Process
3680	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
1080	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
3468	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
3524	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe
3904	{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe	2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe
File created	C:\Windows\{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
File created	C:\Windows\{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
File created	C:\Windows\{C39348E4-5B42-494a-95DE-3365212D2C97}.exe	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
File created	C:\Windows\{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe
2136	cmd.exe
1948	cmd.exe
5116	cmd.exe
4168	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	904	2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	3680	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
Token: SeIncBasePriorityPrivilege	1080	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
Token: SeIncBasePriorityPrivilege	3468	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
Token: SeIncBasePriorityPrivilege	3524	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 3680	904	2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe	91
PID 904 wrote to memory of 1948	904	2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe	92
PID 3680 wrote to memory of 1080	3680	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe	94
PID 3680 wrote to memory of 5116	3680	{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe	95
PID 1080 wrote to memory of 3468	1080	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe	98
PID 1080 wrote to memory of 4168	1080	{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe	99
PID 3468 wrote to memory of 3524	3468	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe	100
PID 3468 wrote to memory of 4752	3468	{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe	101
PID 3524 wrote to memory of 3904	3524	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe	107
PID 3524 wrote to memory of 2136	3524	{C39348E4-5B42-494a-95DE-3365212D2C97}.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_586367bddf4d1c5b840c78e941422a75_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
  C:\Windows\{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Windows\{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
    C:\Windows\{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Windows\{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
      C:\Windows\{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Windows\{C39348E4-5B42-494a-95DE-3365212D2C97}.exe
        
        C:\Windows\{C39348E4-5B42-494a-95DE-3365212D2C97}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3524
      - C:\Windows\{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe
        
        C:\Windows\{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3904
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C3934~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FF1EF~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4752
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5CF8D~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F90C7~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe

Path C:\Windows\{5CF8D8A6-0F39-4fce-91E2-AFCFFA459863}.exe
Size 79KB
SHA256 7a0b42c6241f761c2a3400268030b03ba658644df92aa392f6392b0515a54ba6
MD5 70b58eaf2e08152129927069899c2036
SHA1 bad3553fd7bca437348e6da78089e269c5ca42a1
SHA512 dcce1fb97fb73d90e6be62c0e9039974a064e34e75ef2bc74511ae5c4c88e894ee5378dfc1aceed64fe166e6c270442d5f5ad7ff1390dbb258e8a451365a0b71
SSDEEP 768:4vw9816vhKQLroX4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oXloWMZ3izbR9Xwzz
TLSH
T186834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C39348E4-5B42-494a-95DE-3365212D2C97}.exe

Path C:\Windows\{C39348E4-5B42-494a-95DE-3365212D2C97}.exe
Size 79KB
SHA256 62cbb1cc69d396c35971ca92f5a051cbb5b15992a6356e3ca2df5727aff74cd0
MD5 1a25d0b9be073c5e967454023bbabbad
SHA1 e61db6f5c0a8cadb88f8f27eb0f26216d08e1de2
SHA512 ed7696690376900275a4bb4b636c470d0151549cdb4dd3bf634036b545cb3f462ec3187e5f0f2071d4729e4cbd8f8bc81d84acaa93ef282e8184b8710247c5b9
SSDEEP 768:4vw9816vhKQLrov4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0ovloWMZ3izbR9Xwzz
TLSH
T1B6834BC38E6C6483FE96297012A8DABB7D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe

Path C:\Windows\{D312F31B-FED1-4e61-8137-AA7F5D0628F4}.exe
Size 79KB
SHA256 db3842d26d2cfb6ebc093affc4b82b76501853c8bba4aaddd8c95b9ac5b34628
MD5 70c562e7336cbcefe2bc6df5ebe03c6d
SHA1 39e9e8f79069ca198a32535a12b082cb82ce0e5a
SHA512 0030b78b53805fe9bdbc558acca0a36ca0a9819bde88dcf443a077534d97c855efec97c0fb3c96743afd623ad4017d289aea61a9b4b75bdbd27b0d1fbb61500b
SSDEEP 768:4vw9816vhKQLro04/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0o0loWMZ3izbR9Xwzz
TLSH
T1EB834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe

Path C:\Windows\{F90C7647-FBA3-4481-BB3A-E8C55FF07CD4}.exe
Size 79KB
SHA256 95dd7c7aeee4bd3e71f5499502498c626074a00d8bfa74bc5613bcaf04494ef0
MD5 7af3fddd22aa5e98505ade29b517d2d0
SHA1 1ecdeb04f99ad4e729b349709e7ffb7cb34c6445
SHA512 b5a2c91880532ecf903eda9942414f83f65a0b9c02262fec3933ac70b1673fb8d914e48b7f7cee9f887ae53942b6e7d802ea481da29d105e3774f865ba4cfff5
SSDEEP 768:4vw9816vhKQLroE4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oEloWMZ3izbR9Xwzz
TLSH
T1C6834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe

Path C:\Windows\{FF1EF1B3-DB08-47b5-92F8-240BB89E1BA6}.exe
Size 79KB
SHA256 a682e5b1ee1cbcde1ea5bfb7c9e034fdfabfccbfafb2e61973c54cd1ea4cb9f8
MD5 0a59d8d7db35887e0cce01629aa91cb3
SHA1 257bb2e16f9a9ea171055d41ea7a688ebdb6e9f5
SHA512 23acedb5bac7fb848f26ab9429c938cef483b0a06922888fc0369f8a25c09e22912ec87581ab8abdfaeb427d1de3ed1c4f44ecb5d4e136d46be98beaf36d0e31
SSDEEP 768:4vw9816vhKQLroY4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oYloWMZ3izbR9Xwzz
TLSH
T1F3834CC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads