Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 09:40
General
- Target 23851c6b41aebd81dfbdd9c2d97f986addeac293653e0dd04ba6c38c3a74fb89.exe
- Size 89KB
- Sample260910-lnaczsan9x
- SHA256 23851c6b41aebd81dfbdd9c2d97f986addeac293653e0dd04ba6c38c3a74fb89
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23851c6b41aebd81dfbdd9c2d97f986addeac293653e0dd04ba6c38c3a74fb89.exe"C:\Users\Admin\AppData\Local\Temp\23851c6b41aebd81dfbdd9c2d97f986addeac293653e0dd04ba6c38c3a74fb89.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CC0744B-E2CD-4264-9C61-41DCBBBD435A}.exeC:\Windows\{3CC0744B-E2CD-4264-9C61-41DCBBBD435A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{125A53AD-C4BA-47d1-9314-C55BF4CF0907}.exeC:\Windows\{125A53AD-C4BA-47d1-9314-C55BF4CF0907}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82CAD25E-0F9B-4963-9BDC-81164C16E12E}.exeC:\Windows\{82CAD25E-0F9B-4963-9BDC-81164C16E12E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{085D3BA0-F910-44a9-A227-7FE7B05A5E3F}.exeC:\Windows\{085D3BA0-F910-44a9-A227-7FE7B05A5E3F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94B91EA4-67E8-4ff9-8691-1AECB042101B}.exeC:\Windows\{94B91EA4-67E8-4ff9-8691-1AECB042101B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7336AC9-B915-4e09-9D68-099008205D19}.exeC:\Windows\{C7336AC9-B915-4e09-9D68-099008205D19}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{655DEDD1-3982-45dd-8922-785424954FBA}.exeC:\Windows\{655DEDD1-3982-45dd-8922-785424954FBA}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB6D48B8-60D4-4035-A0F4-912797587EA2}.exeC:\Windows\{CB6D48B8-60D4-4035-A0F4-912797587EA2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1E323BF-10D4-4ea1-BD45-5BD5F148B272}.exeC:\Windows\{E1E323BF-10D4-4ea1-BD45-5BD5F148B272}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76DEB7AC-1BE3-4e01-9888-4182FFB711D0}.exeC:\Windows\{76DEB7AC-1BE3-4e01-9888-4182FFB711D0}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8A501BB-791E-435c-804F-66E5AE6022F0}.exeC:\Windows\{E8A501BB-791E-435c-804F-66E5AE6022F0}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76DEB~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1E32~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB6D4~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{655DE~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7336~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94B91~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{085D3~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82CAD~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{125A5~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CC07~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\23851C~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{085D3BA0-F910-44a9-A227-7FE7B05A5E3F}.exe
{125A53AD-C4BA-47d1-9314-C55BF4CF0907}.exe
{3CC0744B-E2CD-4264-9C61-41DCBBBD435A}.exe
{655DEDD1-3982-45dd-8922-785424954FBA}.exe
{76DEB7AC-1BE3-4e01-9888-4182FFB711D0}.exe
{82CAD25E-0F9B-4963-9BDC-81164C16E12E}.exe
{94B91EA4-67E8-4ff9-8691-1AECB042101B}.exe
{C7336AC9-B915-4e09-9D68-099008205D19}.exe
{CB6D48B8-60D4-4035-A0F4-912797587EA2}.exe
{E1E323BF-10D4-4ea1-BD45-5BD5F148B272}.exe
{E8A501BB-791E-435c-804F-66E5AE6022F0}.exe