stormser | 47f9ed46f8c6fe30c0d52992aef332cf0d4ff6f3c46dfcc5dfac44604e163970

General

Target
2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe
Size 59KB
Sample260819-wfchgseq7v
SHA256 47f9ed46f8c6fe30c0d52992aef332cf0d4ff6f3c46dfcc5dfac44604e163970
MD5 b5b1454136f3cf3a35ca45a4ffe65068
SHA1 a1f3bded7a25feb5c946ee099ea36fbb0a296d28
SHA512 a52ff7946d78084a91994bb96c9be3b1c5f7dd9dd20e9db88b6c51f92c85feb263a869f2fb9139d7f14aa9642dd3b8a3c8626244dc8e2aa69b23a7e0e3921b01
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrow4/CFsrdHWMZ:Mvw9816vhKQLrow4/wQpWMZ
TLSH
T1A3433B834F997CF2FB810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x0002000000022b94-2.dat	family_stormser
behavioral1/files/0x000500000001e44f-6.dat	family_stormser
behavioral1/files/0x0008000000024658-10.dat	family_stormser
behavioral1/files/0x0007000000024666-14.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/files/0x0002000000022b94-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000500000001e44f-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024658-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024666-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}\stubpath = "C:\\Windows\\{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe"	2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}\stubpath = "C:\\Windows\\{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe"	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}\stubpath = "C:\\Windows\\{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe"	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}\stubpath = "C:\\Windows\\{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe"	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}	2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe

Executes dropped EXE 4 IoCs

pid	Process
2192	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
5684	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
5132	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe
3400	{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
File created	C:\Windows\{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
File created	C:\Windows\{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe
File created	C:\Windows\{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe	2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2736	cmd.exe
5240	cmd.exe
328	cmd.exe
5192	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3428	2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	2192	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
Token: SeIncBasePriorityPrivilege	5684	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
Token: SeIncBasePriorityPrivilege	5132	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 2192	3428	2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe	87
PID 3428 wrote to memory of 2736	3428	2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe	88
PID 2192 wrote to memory of 5684	2192	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe	89
PID 2192 wrote to memory of 5240	2192	{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe	90
PID 5684 wrote to memory of 5132	5684	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe	94
PID 5684 wrote to memory of 328	5684	{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe	95
PID 5132 wrote to memory of 3400	5132	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe	103
PID 5132 wrote to memory of 5192	5132	{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b5b1454136f3cf3a35ca45a4ffe65068_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Windows\{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
  C:\Windows\{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
    C:\Windows\{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5684
  - - C:\Windows\{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe
      C:\Windows\{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5132
    - - C:\Windows\{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe
        
        C:\Windows\{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B14AE~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5A416~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FD180~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe

Path C:\Windows\{5A416DDA-38E5-45c1-A0D8-E7F0C77D1313}.exe
Size 59KB
SHA256 81e1952ee154a93a4cfe6ab0e7db1877d827636a28b7926e42cb33a397e563a4
MD5 eb83341572f02f989025b7148866686c
SHA1 101c0054aa047fb72b8140e62f3a6ba185587f83
SHA512 bf2dc29f819ed64ae222536eb976a05a417f3c46c364acbe054bc6f6f59416f49ce2bcfceda9642d78c0557113f7bdcc4afa1cc2ebd1fa5e5e25762287a0148f
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroL4/CFsrdHWMZ:Mvw9816vhKQLroL4/wQpWMZ
TLSH
T1C5433B830F997CF2F7810175043A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe

Path C:\Windows\{B14AEDDD-F1AA-4da3-B3DD-8B49EC5ED04F}.exe
Size 59KB
SHA256 2acbd760377f86b3122b48daf68bb6bc6fbc72cddf89cd1438442b8bb3926257
MD5 db19a932ee884d82d2f377f5b22a4078
SHA1 9f7aa814f4deb863ad294a3da0b5d2c7b93549c8
SHA512 fed12c4421d30ae2bc3df6a8db5693ac4b3a85917bd9aa40d260d40d8253a007b1dd05a803801ff700d6c713be955a84e9b45fd638c107263e4e143a3cfa288a
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrop4/CFsrdHWMZ:Mvw9816vhKQLrop4/wQpWMZ
TLSH
T13D433B830F997CF2FB810175047A8BB992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe

Path C:\Windows\{E13431B1-3415-4f19-8C7B-CDDEFA9721D6}.exe
Size 59KB
SHA256 76959be6ef0974f598d29e0e3a2061cb3c47827ab99a3758fade4e3a62fc74fe
MD5 0c9930ee8912c04654a2fb62cdd40e3a
SHA1 9021542ff5dc5b7910a0a18410abad658e05e160
SHA512 99921f156319da6ef05d5dfe05813f105b4315e50837e3d12fbe339328f4263db4014f5c5e74fa8bc5550254b991c798afa234251d102c8c799195871d455d6f
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroA4/CFsrdHWMZ:Mvw9816vhKQLroA4/wQpWMZ
TLSH
T187433B834F997CF2FB810175043A8B7992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe

Path C:\Windows\{FD180313-DE00-4bd7-86F8-5240B7B5D3FB}.exe
Size 59KB
SHA256 2b8fa7c95c2c684f0ee4ffe78ba67039ad19d93d99830c244eb16373a4fb64e7
MD5 e7d1b5ab00dcffad5a170a43ff504662
SHA1 680e1cf4bc0d1b83a4c2801bedac26f0867a2f61
SHA512 12eaa1dd0f3b65ebb44c08a0e7387b3be83d2818ff38d366988887fc843555713cb0a3c2c31f21c0020f3a38b3d3c198f25525b7e54ccc4d6b362c30b51c1474
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLror4/CFsrdHWMZ:Mvw9816vhKQLror4/wQpWMZ
TLSH
T11E433B830F997CF2FB810175047A8B7992AB59D4D14FFE9BBF90CC194436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads