Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/09/2026, 16:17
General
- Target 2026-09-01_1040bd0407c381eeb398ea7c62775471_elex_rhadamanthys_smoke-loader_wannacry.exe
- Size 833KB
- Sample260903-trf9psad35
- SHA256 ab19e105d08a54e6201dec57d561aac2cd8c69737ed6d93c333bd3bd196c2c41
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_1040bd0407c381eeb398ea7c62775471_elex_rhadamanthys_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_1040bd0407c381eeb398ea7c62775471_elex_rhadamanthys_smoke-loader_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{117ECCCE-C866-44bb-AB94-3AFF924604EC}.exeC:\Windows\{117ECCCE-C866-44bb-AB94-3AFF924604EC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C5E2AFC9-5F9E-4e51-AD9E-5218D501F47D}.exeC:\Windows\{C5E2AFC9-5F9E-4e51-AD9E-5218D501F47D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26ECB142-88DE-4de1-8043-D0179FA25A46}.exeC:\Windows\{26ECB142-88DE-4de1-8043-D0179FA25A46}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8C2C7D7-D98F-4d0e-B522-B524356FE5E9}.exeC:\Windows\{E8C2C7D7-D98F-4d0e-B522-B524356FE5E9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE2D0213-0C32-4609-8828-C5665ADF3724}.exeC:\Windows\{DE2D0213-0C32-4609-8828-C5665ADF3724}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBB33CFB-39C2-4530-89A6-B5FF75CBB1DE}.exeC:\Windows\{CBB33CFB-39C2-4530-89A6-B5FF75CBB1DE}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C32881E-5FCD-4506-8734-EC80840DD013}.exeC:\Windows\{0C32881E-5FCD-4506-8734-EC80840DD013}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6058B456-AE9F-4d94-8020-5F2FA7782BDA}.exeC:\Windows\{6058B456-AE9F-4d94-8020-5F2FA7782BDA}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{319898B2-C57B-4162-A0C9-EB4ADB215040}.exeC:\Windows\{319898B2-C57B-4162-A0C9-EB4ADB215040}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01A3995B-5505-4503-91EC-80255D1596DE}.exeC:\Windows\{01A3995B-5505-4503-91EC-80255D1596DE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BEF8559D-0CB6-46fe-8C8C-A3DCE370F5DA}.exeC:\Windows\{BEF8559D-0CB6-46fe-8C8C-A3DCE370F5DA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01A39~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31989~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6058B~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C328~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBB33~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE2D0~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8C2C~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26ECB~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5E2A~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{117EC~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{01A3995B-5505-4503-91EC-80255D1596DE}.exe
{0C32881E-5FCD-4506-8734-EC80840DD013}.exe
{117ECCCE-C866-44bb-AB94-3AFF924604EC}.exe
{26ECB142-88DE-4de1-8043-D0179FA25A46}.exe
{319898B2-C57B-4162-A0C9-EB4ADB215040}.exe
{6058B456-AE9F-4d94-8020-5F2FA7782BDA}.exe
{BEF8559D-0CB6-46fe-8C8C-A3DCE370F5DA}.exe
{C5E2AFC9-5F9E-4e51-AD9E-5218D501F47D}.exe
{CBB33CFB-39C2-4530-89A6-B5FF75CBB1DE}.exe
{DE2D0213-0C32-4609-8828-C5665ADF3724}.exe
{E8C2C7D7-D98F-4d0e-B522-B524356FE5E9}.exe