stormser | eb52c615f250d2be6cd48cfd75241930933ce84e4e05b6600d2116efbf70e9c4

General

Target
2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe
Size 60KB
Sample260822-lf87caxtg1
SHA256 eb52c615f250d2be6cd48cfd75241930933ce84e4e05b6600d2116efbf70e9c4
MD5 9d501cdbba0fde87b44f852227c2c7e0
SHA1 f34c2d351b0f6d005305f1acd3862585689dd14e
SHA512 7111d94cbcef6dce92173bd128dc3266cb071d9905a44875bd70ec980fdba0452d2d34ee6c0792829173bb48531a4cc2e712328ba4bbf8cbc4d31d6de86f07a0
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwZIY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLrok4/CFsrd
TLSH
T15853F8834BDE5CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000800000002454a-2.dat	family_stormser
behavioral1/files/0x0007000000024554-6.dat	family_stormser
behavioral1/files/0x000400000001da8c-8.dat	family_stormser
behavioral1/files/0x0007000000024562-14.dat	family_stormser
behavioral1/files/0x0008000000024564-19.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E54680A-EA77-422c-9B01-75DCB6302F13}	2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E54680A-EA77-422c-9B01-75DCB6302F13}\stubpath = "C:\\Windows\\{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe"	2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}	{47B2443A-061C-4981-A174-C148B9D799AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}\stubpath = "C:\\Windows\\{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe"	{47B2443A-061C-4981-A174-C148B9D799AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}\stubpath = "C:\\Windows\\{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe"	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3163C3E7-CF3B-44eb-935C-2314614DD5F5}	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47B2443A-061C-4981-A174-C148B9D799AB}	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{47B2443A-061C-4981-A174-C148B9D799AB}\stubpath = "C:\\Windows\\{47B2443A-061C-4981-A174-C148B9D799AB}.exe"	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3163C3E7-CF3B-44eb-935C-2314614DD5F5}\stubpath = "C:\\Windows\\{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe"	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe

Executes dropped EXE 5 IoCs

pid	Process
3364	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe
756	{47B2443A-061C-4981-A174-C148B9D799AB}.exe
3500	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
1764	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe
2280	{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe	{47B2443A-061C-4981-A174-C148B9D799AB}.exe
File created	C:\Windows\{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
File created	C:\Windows\{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe
File created	C:\Windows\{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe	2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe
File created	C:\Windows\{47B2443A-061C-4981-A174-C148B9D799AB}.exe	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3776	cmd.exe
2068	cmd.exe
3056	cmd.exe
5096	cmd.exe
4424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{47B2443A-061C-4981-A174-C148B9D799AB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4292	2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3364	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe
Token: SeIncBasePriorityPrivilege	756	{47B2443A-061C-4981-A174-C148B9D799AB}.exe
Token: SeIncBasePriorityPrivilege	3500	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
Token: SeIncBasePriorityPrivilege	1764	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 3364	4292	2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe	85
PID 4292 wrote to memory of 3776	4292	2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe	86
PID 3364 wrote to memory of 756	3364	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe	94
PID 3364 wrote to memory of 2068	3364	{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe	95
PID 756 wrote to memory of 3500	756	{47B2443A-061C-4981-A174-C148B9D799AB}.exe	97
PID 756 wrote to memory of 3056	756	{47B2443A-061C-4981-A174-C148B9D799AB}.exe	98
PID 3500 wrote to memory of 1764	3500	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe	99
PID 3500 wrote to memory of 5096	3500	{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe	100
PID 1764 wrote to memory of 2280	1764	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe	102
PID 1764 wrote to memory of 4424	1764	{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_9d501cdbba0fde87b44f852227c2c7e0_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe
  C:\Windows\{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\{47B2443A-061C-4981-A174-C148B9D799AB}.exe
    C:\Windows\{47B2443A-061C-4981-A174-C148B9D799AB}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Windows\{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
      C:\Windows\{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3500
    - - C:\Windows\{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe
        
        C:\Windows\{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1764
      - C:\Windows\{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe
        
        C:\Windows\{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2280
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7CCC9~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0A26A~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5096
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{47B24~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{0E546~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2068
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe

Path C:\Windows\{0A26A453-6FA4-44bb-91B7-F3EE362C90C3}.exe
Size 60KB
SHA256 cf320a784570fe24d449241ce41cd0f3f6b9954396ef6a9b8e7936ffc07cc60f
MD5 49c56ca1d8d01550d573dd5458cd9b10
SHA1 c22df6afcb7aed203376bc138328e5b0ae36a313
SHA512 42e09eabfe066e25ca41f07bce825a35b845ccce1be5b26a165881c505ec4e7e37d1a907a62ebbef73ee2f7043dc6654ea775dc66a95add085851a224fe423f2
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwqY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroA4/CFsrd
TLSH
T19353F8834BEE5CF2F791123108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe

Path C:\Windows\{0E54680A-EA77-422c-9B01-75DCB6302F13}.exe
Size 60KB
SHA256 769dde0c4d390b6b8ce8c4b1e60989c020a413ca8ba1ca3f7fe524e6d329afa8
MD5 73d3af4a8093dd11ead852ad6b12328b
SHA1 c1d13fe9cccfe13fce02bd62e9ac0ccc26e93345
SHA512 19048c28a14f51edb5debf21324243f97de3f20553bf1f2201df4752697b8645060d52520788fb0785accdb730b31cc787c0d06d5d184d9e1e80f75d7875450d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwUY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroi4/CFsrd
TLSH
T19953F8834BDE9CF2F791127108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe

Path C:\Windows\{3163C3E7-CF3B-44eb-935C-2314614DD5F5}.exe
Size 60KB
SHA256 7a5311bfcd02d5e9cc5f7558a38090d4eefad240489908f156e938f6ad818f3e
MD5 9ac85d201fdd03b51b1be2e8097fc34b
SHA1 59df6614ebc94b2609a3a42523f6ffe5f5c12e50
SHA512 4454c74ac3184beb73aa040ecd6efafcb2cfa300a8ae554c2ddb0ec0c999f57687ab356a920c32dea2fff05b09d5198ce28e8178879725546e18a8c5d2f252de
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwcwY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLro/4/CFsrd
TLSH
T1F353F8834BDE5CF2F791117108794AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{47B2443A-061C-4981-A174-C148B9D799AB}.exe

Path C:\Windows\{47B2443A-061C-4981-A174-C148B9D799AB}.exe
Size 60KB
SHA256 9a02af8e52430d3d4eaec568ac1703dd5dd1812813d62d90e29e9dbc2af47529
MD5 c11400b39ed4724962de8060a1401a08
SHA1 3c9a46612b95e63fd844279d40d97c32fb548a75
SHA512 492e11ce26752b69d323d00cf21558b3d74da8ba1b05dbc9d6961fd2f48d2664588d3ffa3f048e9a607861dd346db9a55b662f6a2929a4e803adef7da3007156
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwnY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroZ4/CFsrd
TLSH
T14D53F8834BEE5CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe

Path C:\Windows\{7CCC94D1-FFB1-4b86-90AB-A772767BEB56}.exe
Size 60KB
SHA256 4c5e530637096258c67c04e4f57335e79e95933b8b35313414b32ce26a0435b7
MD5 83a33663e21297ad4ad9a63cea3cbc6a
SHA1 de38ca7f59eb39241d5f3df80d08accf111d8213
SHA512 d8b694f23d549edbe11ced62547271e61c33735d6cef9e7639400ce43cd218e4d560351b671427f71603c044120a91736a5cc3104552050e23fedb43a05ab42d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwLO5Y04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroQ4/CFsrd
TLSH
T1E353F8834BDE5CF2F791127108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads