stormser | 22e4b9b5252d5a0bf261dcf65170325a0b2e1d37db1d85de353e08b62df24bf2

General

Target
2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe
Size 60KB
Sample260820-ld8ssstdjg
SHA256 22e4b9b5252d5a0bf261dcf65170325a0b2e1d37db1d85de353e08b62df24bf2
MD5 eac41044c370e495b603e46f9934c100
SHA1 59836e27bfa86f4af61c750d1fa1d8764483f32e
SHA512 5952ef300098d886d735d8cb62bb6e95b93658a57d933b55818d49bf28799f0566f00b6c96359330531f19e05c1c221fac33a6cc6803bef3383a46753cb78e36
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQL4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQL4/wQTGaWhj8s
TLSH
T105537C835BEA2CF2F6F10236057859B5D22B9AD4A15DBEDBBB90CE1604372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 8 IoCs

resource	yara_rule
behavioral1/files/0x00030000000006d5-2.dat	family_stormser
behavioral1/files/0x0003000000000703-7.dat	family_stormser
behavioral1/files/0x00170000000168e3-8.dat	family_stormser
behavioral1/files/0x000400000001690a-15.dat	family_stormser
behavioral1/files/0x000900000001d8a6-18.dat	family_stormser
behavioral1/files/0x001a00000001db5a-22.dat	family_stormser
behavioral1/files/0x000300000001e0b1-26.dat	family_stormser
behavioral1/files/0x000700000001e683-30.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79E1567D-F2D2-4215-B910-E17AB17C9DA5}\stubpath = "C:\\Windows\\{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe"	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76AF05AC-2E39-4d7c-860A-1F76A77C1915}\stubpath = "C:\\Windows\\{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe"	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A69C35F9-190F-4b82-AE51-614CC0BBA637}	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76AF05AC-2E39-4d7c-860A-1F76A77C1915}	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4908926-5EB4-4abf-9E7A-3D065A9BD087}	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4908926-5EB4-4abf-9E7A-3D065A9BD087}\stubpath = "C:\\Windows\\{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe"	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EA7F594-947D-470b-957C-A021309BA83D}\stubpath = "C:\\Windows\\{9EA7F594-947D-470b-957C-A021309BA83D}.exe"	2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}\stubpath = "C:\\Windows\\{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe"	{9EA7F594-947D-470b-957C-A021309BA83D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A973B140-B851-43fb-AC19-725B87E8D9E7}	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A69C35F9-190F-4b82-AE51-614CC0BBA637}\stubpath = "C:\\Windows\\{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe"	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9EA7F594-947D-470b-957C-A021309BA83D}	2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}	{9EA7F594-947D-470b-957C-A021309BA83D}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7908FEEF-39DA-479b-97C6-F11132078CE3}\stubpath = "C:\\Windows\\{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe"	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A973B140-B851-43fb-AC19-725B87E8D9E7}\stubpath = "C:\\Windows\\{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe"	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7908FEEF-39DA-479b-97C6-F11132078CE3}	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79E1567D-F2D2-4215-B910-E17AB17C9DA5}	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe

Executes dropped EXE 8 IoCs

pid	Process
4644	{9EA7F594-947D-470b-957C-A021309BA83D}.exe
4720	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
3988	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
4956	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
740	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
3720	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
1780	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe
1400	{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\{9EA7F594-947D-470b-957C-A021309BA83D}.exe	2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe
File created	C:\Windows\{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe	{9EA7F594-947D-470b-957C-A021309BA83D}.exe
File created	C:\Windows\{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
File created	C:\Windows\{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
File created	C:\Windows\{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
File created	C:\Windows\{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
File created	C:\Windows\{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
File created	C:\Windows\{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
632	cmd.exe
1672	cmd.exe
3372	cmd.exe
3824	cmd.exe
2684	cmd.exe
2724	cmd.exe
4788	cmd.exe
3884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{9EA7F594-947D-470b-957C-A021309BA83D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4492	2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4644	{9EA7F594-947D-470b-957C-A021309BA83D}.exe
Token: SeIncBasePriorityPrivilege	4720	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
Token: SeIncBasePriorityPrivilege	3988	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
Token: SeIncBasePriorityPrivilege	4956	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
Token: SeIncBasePriorityPrivilege	740	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
Token: SeIncBasePriorityPrivilege	3720	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
Token: SeIncBasePriorityPrivilege	1780	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4644	4492	2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe	89
PID 4492 wrote to memory of 1672	4492	2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe	90
PID 4644 wrote to memory of 4720	4644	{9EA7F594-947D-470b-957C-A021309BA83D}.exe	91
PID 4644 wrote to memory of 3372	4644	{9EA7F594-947D-470b-957C-A021309BA83D}.exe	92
PID 4720 wrote to memory of 3988	4720	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe	95
PID 4720 wrote to memory of 3824	4720	{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe	96
PID 3988 wrote to memory of 4956	3988	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe	97
PID 3988 wrote to memory of 2684	3988	{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe	98
PID 4956 wrote to memory of 740	4956	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe	99
PID 4956 wrote to memory of 2724	4956	{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe	100
PID 740 wrote to memory of 3720	740	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe	101
PID 740 wrote to memory of 4788	740	{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe	102
PID 3720 wrote to memory of 1780	3720	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe	109
PID 3720 wrote to memory of 3884	3720	{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe	110
PID 1780 wrote to memory of 1400	1780	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe	111
PID 1780 wrote to memory of 632	1780	{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_eac41044c370e495b603e46f9934c100_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\{9EA7F594-947D-470b-957C-A021309BA83D}.exe
  C:\Windows\{9EA7F594-947D-470b-957C-A021309BA83D}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
    C:\Windows\{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
      C:\Windows\{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Windows\{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
        
        C:\Windows\{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4956
      - C:\Windows\{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
        
        C:\Windows\{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
        
        C:\Windows\{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe
        
        C:\Windows\{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Windows\{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe
        
        C:\Windows\{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C4908~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:632
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{76AF0~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79E15~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4788
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A973B~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2724
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7908F~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{FBCDF~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{9EA7F~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe

Path C:\Windows\{76AF05AC-2E39-4d7c-860A-1F76A77C1915}.exe
Size 60KB
SHA256 8d9e38571649ebdfede261e3c96e43911abbc04eb9eb99c0de79863c31eb2e00
MD5 8d4635a9742c9309bb85b4d61dc72e1e
SHA1 9f441438efc8b2ae75d2d8906e634c3642a7f360
SHA512 9104efe7878ca80a8316a217a86beddac62ba161efa95914fbdccb007b517bed1ce66fd78159948530cb91629117c3a8bf7fad7701eac8a1f208cb639aed04fe
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQC4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQC4/wQTGaWhj8s
TLSH
T1EE537C835BEA2CF2F6F1123205785AB5D22B99D4A15DBEDBBB80CE1604372D1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe

Path C:\Windows\{7908FEEF-39DA-479b-97C6-F11132078CE3}.exe
Size 60KB
SHA256 6cc6d949f51f53bab5959c771ab6f3e6139e55677c5196457a6554ea36028809
MD5 b0f4912de1c3c165c0999070e262cfee
SHA1 42c2a60fa802d69ef03397ca082556484be36daa
SHA512 1ae8b25af13e409983342f9beeef3498e7d83b61c245449c2ed3890f79b60346f24c0fce86d72a65a3c72dbe007a096d832021eea6083b81f438bd062cc7bfd0
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQH4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQH4/wQTGaWhj8s
TLSH
T1DA537C836BEA2CF2F6F11232057859B5D22B9AD5A15DBEDBBB80CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe

Path C:\Windows\{79E1567D-F2D2-4215-B910-E17AB17C9DA5}.exe
Size 60KB
SHA256 3f7192409bbe4da1680b5df74e8cfb5b169ddb13798e0e20fe71a748f872ef8e
MD5 14a2d8d324fd3354018dd9614425c920
SHA1 bca088dc23324aedc369e6b8f7740b6c65a57b38
SHA512 454422554c894458153178db6d5cab5acbeea0487e5a63aee925441493d33ab9d040c8c509f23ed83a740e4f99d1b0caf9607c0d6732842c04a3be0e4a39c443
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQZ4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQZ4/wQTGaWhj8s
TLSH
T142537C835BEA2CF2F6F10236057859B5D22B9AD4A15DBEDBBB80CE1504372D1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9EA7F594-947D-470b-957C-A021309BA83D}.exe

Path C:\Windows\{9EA7F594-947D-470b-957C-A021309BA83D}.exe
Size 60KB
SHA256 76807492c69083d8ad7f10fbaa5ff1a167b0d8fa9cfe59f26b160bc25d599f5c
MD5 129a13aca66cf2b28ac34a49f515a80e
SHA1 478d5013ede29a33e2dd93f4157de467f25ed90b
SHA512 48dc2e3fbc3aac3f474301f5a9cdd4c8e3a33bacc0c26b5c55b8af1e28d5c24b44766d5394d929788a062f010aeb3c53fe48c75a7d06d323fcae83eaf42dbff8
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQA4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQA4/wQTGaWhj8s
TLSH
T154538C835BEA2CF2F2F10232057859B5D22B9AD5A15DBEDBBB80CE1604372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe

Path C:\Windows\{A69C35F9-190F-4b82-AE51-614CC0BBA637}.exe
Size 60KB
SHA256 8f7d5900c57a40ddd7fa12e82c60c11240946445fb2542b1bf5dd9cab76e0e5b
MD5 0343eca4ffe1c9432b40537996d501ee
SHA1 85f63cbb2a0fee97d42efc77142666961124aa84
SHA512 a731e086fb13ce48608537becc1dea31ae815ad5a4741e7509e716ab68441df033264b0fe180b26e82c2cb7f1013c1821f72c06ade049c104c0f16f938e82584
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQf4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQf4/wQTGaWhj8s
TLSH
T1BC538C836BEA2CF2F6F11232057859B4D22B9AD4A15DBEDBBB80CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe

Path C:\Windows\{A973B140-B851-43fb-AC19-725B87E8D9E7}.exe
Size 60KB
SHA256 003b2ad1f2d3ca55c7b22363e7bf2c8f9d6ab40f0d878f937fff40e535f29459
MD5 8eb73bff0022acf349455c7309ce1dcf
SHA1 c3d4ab676c5d9856588a407ef41243731bf1b59e
SHA512 750416166f8be927bb4f51e093707e9cf3f4ce4a77d1fed5a2ec12e26346fd9ff0b7430c55f35f0be2e4e9f22e047a83aacaa6b3943ecc2bd8622a0c1dcd0fdc
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQK4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQK4/wQTGaWhj8s
TLSH
T17E537C836BEA2CF2F6F10232057859B5D22B9AD4A15DBEDBBB80CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe

Path C:\Windows\{C4908926-5EB4-4abf-9E7A-3D065A9BD087}.exe
Size 60KB
SHA256 c9c2477e40da781f60cbbaaa883ebcce844b43176b3b613fab554e4d6a9a36f0
MD5 a739fe849cc929762b5cdedca436a691
SHA1 d83e09e0fbee924a833e24c48726827bcf9eb820
SHA512 ce1b57c79c1fa457e22379f46f5cd422ce86ba6431f288341786a52c412108e8cf8c966a56a82118910a9fe28bd0d42ebceaba21e72d6c175506684981a3ed69
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQrw4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQk4/wQTGaWhj8s
TLSH
T119537C836BEA2CF2F6F11232057859B5D22B9AD4A15DBEDBBB80CE1504372D1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe

Path C:\Windows\{FBCDF4A6-F9F6-4eca-B56F-20FCDECAE8E2}.exe
Size 60KB
SHA256 9d86e9fd562d2758862c48a94d862eb0040f64fd3f16ec87263995167a00b6b2
MD5 471adfc5349675568422719444ad56f2
SHA1 94ddee9d63c47fffa4386da05c074c40b8f8b0de
SHA512 ba393fa0b1b9a7e36a2f600ba57dde4d363018833ff3849273e883bb0686fae831742b1eb883226bfd448a4694fd180de1378338fb8446ea5435f36ee80481fd
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQc4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQc4/wQTGaWhj8s
TLSH
T1D2537D835BEA2CF2F6F1023605B859B5D22B99D4A15DBEDBBB80CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads