stormser | 73f0c154cb69103b5c9f693625b81e14a5266b06f32a6289be133bcd8f21a011

General

Target
2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe
Size 64KB
Sample260817-d6schsszgs
SHA256 73f0c154cb69103b5c9f693625b81e14a5266b06f32a6289be133bcd8f21a011
MD5 44b6723cff9bbc4e0432758b5241b98e
SHA1 82a270f837e1bace534265dc2059d4c62d9f8298
SHA512 fb9da9e25b28876964096554d72af61ab0736abc9fa25c844c480056ec9cb2d60953110b7102a70cfbd8cae13c9bc3c23833812951b1c84f07d85a9dfd0d3d32
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroM4/CFsrdn0A9lsy4:vvw9816vhKQLroM4/wQH9lsl
TLSH
T12D535C834BEE98F2F7D20131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000300000001da56-2.dat	family_stormser
behavioral1/files/0x000400000001dabe-6.dat	family_stormser
behavioral1/files/0x001400000001db63-8.dat	family_stormser
behavioral1/files/0x001a00000001db5a-14.dat	family_stormser
behavioral1/files/0x000200000001e73f-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}	2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2F4F05B-462D-491e-AD85-0CA5C263657D}	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A2F4F05B-462D-491e-AD85-0CA5C263657D}\stubpath = "C:\\Windows\\{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe"	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}\stubpath = "C:\\Windows\\{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe"	2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}\stubpath = "C:\\Windows\\{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe"	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}\stubpath = "C:\\Windows\\{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe"	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}\stubpath = "C:\\Windows\\{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe"	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe

Executes dropped EXE 5 IoCs

pid	Process
4116	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
3948	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
228	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
4220	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
1996	{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
File created	C:\Windows\{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
File created	C:\Windows\{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe	2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe
File created	C:\Windows\{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
File created	C:\Windows\{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4464	cmd.exe
1032	cmd.exe
220	cmd.exe
4228	cmd.exe
1136	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	536	2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4116	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
Token: SeIncBasePriorityPrivilege	3948	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
Token: SeIncBasePriorityPrivilege	228	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
Token: SeIncBasePriorityPrivilege	4220	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4116	536	2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe	95
PID 536 wrote to memory of 4464	536	2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe	96
PID 4116 wrote to memory of 3948	4116	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe	97
PID 4116 wrote to memory of 1032	4116	{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe	98
PID 3948 wrote to memory of 228	3948	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe	100
PID 3948 wrote to memory of 220	3948	{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe	101
PID 228 wrote to memory of 4220	228	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe	105
PID 228 wrote to memory of 4228	228	{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe	106
PID 4220 wrote to memory of 1996	4220	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe	107
PID 4220 wrote to memory of 1136	4220	{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_44b6723cff9bbc4e0432758b5241b98e_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
  C:\Windows\{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
    C:\Windows\{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
      C:\Windows\{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:228
    - - C:\Windows\{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
        
        C:\Windows\{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4220
      - C:\Windows\{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe
        
        C:\Windows\{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1996
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{5DBEA~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FBDEB~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{21275~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7074A~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe

Path C:\Windows\{212751B2-1CE7-4f88-B9C4-4CAF18F39BDA}.exe
Size 64KB
SHA256 e169b853afc63fdbffcb9b1211bdb532ec73aa668dea38ce23994c829037061a
MD5 b499551cbb9a6dec352fe452721a195f
SHA1 95b02207b10d1cf362b222bcfd0d7f700f0f54a5
SHA512 f30bb58be90f84edf57b4c806d33219e1594839ba5d16bf7808ada08d23d6129377397670cabf407a47b0a395de1f48a2b9a2f24873254d38aec0746022ebce9
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroC4/CFsrdn0A9lsy4:vvw9816vhKQLroC4/wQH9lsl
TLSH
T19E535C834BEE98F2F7D20131046D8A798277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe

Path C:\Windows\{5DBEA4A0-E595-4f91-B1E5-ADFE92C9FBE0}.exe
Size 64KB
SHA256 948ea03d48dd76b0d1cbf58485b4864249721488936d01d2d0b58cf51a083817
MD5 b0604b8cf49e569296a166de93945ad9
SHA1 930ef27f78ea9db390a7bbfbc73e3f381a6c792a
SHA512 471d2d522a1d458a45496d63ace820e8a13943f39985dc8b3f226aa76d1bf9d54b2c62a92f73de952585632511f693f4649e693de1864ccdb6a81a69391acb0d
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroX4/CFsrdn0A9lsy4:vvw9816vhKQLroX4/wQH9lsl
TLSH
T1D6535C834BEE98F2F7D20131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe

Path C:\Windows\{7074ACCA-99B0-4454-8E20-B00E0EE21B4B}.exe
Size 64KB
SHA256 623012f9b45a03022b1fa7e4b17483f4f01f42b2cfb571268b7b75136bdef048
MD5 5fa7aa8f6b34eda383cac978d8f6f243
SHA1 21cea13175353790d0d93192cc7f4fbc58875b82
SHA512 815caa781124ec7a75f9ba1e9ccf2ee688f88b1022907e0efa9f7d97bfe9b25953d29e44d7237eabfa07712f1ed4845109dbba810f8b5f3f439fa01ca761cf5b
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLro84/CFsrdn0A9lsy4:vvw9816vhKQLro84/wQH9lsl
TLSH
T1E8535C834BEE98F2F7D21131056D8AB98277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe

Path C:\Windows\{A2F4F05B-462D-491e-AD85-0CA5C263657D}.exe
Size 64KB
SHA256 c4057e70e756af3603774532724083405d122a56c509c640d9175ce180333e19
MD5 441cd44b668202f7d389de91f0773b16
SHA1 460988315ada616c50f5a75b9fa4ed12b646476a
SHA512 b070e11bbc2d12310b7858236ed80b87b587a35025b8de5e1b2bf2a6c33d542ea4e60710bd8260a7176070b6b58c96809d74395e5fc0dbfbc4b9aa873a1e80ff
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrou4/CFsrdn0A9lsy4:vvw9816vhKQLrou4/wQH9lsl
TLSH
T1AF535C834BEE98F2F7D21131046D8AB98277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe

Path C:\Windows\{FBDEBDF4-05E6-48ac-B614-33F343B1AA1B}.exe
Size 64KB
SHA256 b0bd420f6151fbbe01099e3e192d48102c683801714f1e3ba477ea1ee2861af7
MD5 fa389c6054ac40d5e48351e6c4fc83d2
SHA1 353c086664d2964ab06ef43b38afe3d1b984e015
SHA512 53866a0666c6664ab256164093cb3f2f921a56a2cc42a27bde9c3cd9c279c53ff533e279b322cd00e0b6e69cc8da1ed1763a7ca4c7d99eb237c4bcedbee1c2b3
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroa4/CFsrdn0A9lsy4:vvw9816vhKQLroa4/wQH9lsl
TLSH
T1FF535C834BEE98F2F7920131046D8A799277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads