Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/09/2026, 22:36
General
- Target 2026-09-20_f1f79a1b368cca8ed5be1d3d55f9d712_elex_rhadamanthys_smoke-loader_wannacry.exe
- Size 833KB
- Sample260920-2jkadstyfw
- SHA256 ae84eec04ddd18bc931cb995828dbd6b5627cadbbb7ebc70c74e1161eb26f4ee
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-20_f1f79a1b368cca8ed5be1d3d55f9d712_elex_rhadamanthys_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-20_f1f79a1b368cca8ed5be1d3d55f9d712_elex_rhadamanthys_smoke-loader_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7622167-A434-4b86-A4D8-1BD1226E3651}.exeC:\Windows\{B7622167-A434-4b86-A4D8-1BD1226E3651}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67CCBA9E-18AE-467b-B35B-58F9D2403ACB}.exeC:\Windows\{67CCBA9E-18AE-467b-B35B-58F9D2403ACB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD863825-8DBF-458d-A5F1-65984E948056}.exeC:\Windows\{BD863825-8DBF-458d-A5F1-65984E948056}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4C43794B-6151-4799-9CB9-CEB9212F6BCC}.exeC:\Windows\{4C43794B-6151-4799-9CB9-CEB9212F6BCC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE7B7A39-4BF0-436c-88AD-1DC093437885}.exeC:\Windows\{AE7B7A39-4BF0-436c-88AD-1DC093437885}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D1D69B4-FB58-465d-9601-68EA8FDDD117}.exeC:\Windows\{7D1D69B4-FB58-465d-9601-68EA8FDDD117}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CFB9E64-6D86-4216-99BC-D6F82A529966}.exeC:\Windows\{0CFB9E64-6D86-4216-99BC-D6F82A529966}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1E83C33-9170-43b3-91E3-E248FAE85E98}.exeC:\Windows\{F1E83C33-9170-43b3-91E3-E248FAE85E98}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF247AB4-1881-4f38-8BAB-3B09AC508F69}.exeC:\Windows\{CF247AB4-1881-4f38-8BAB-3B09AC508F69}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{639C1E26-BF9B-48f6-82CA-3B04A07CF0CF}.exeC:\Windows\{639C1E26-BF9B-48f6-82CA-3B04A07CF0CF}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9324B3BE-98DB-4b73-87A8-594E3191F3BF}.exeC:\Windows\{9324B3BE-98DB-4b73-87A8-594E3191F3BF}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{639C1~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF247~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1E83~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CFB9~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D1D6~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE7B7~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4C437~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD863~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67CCB~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7622~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0CFB9E64-6D86-4216-99BC-D6F82A529966}.exe
{4C43794B-6151-4799-9CB9-CEB9212F6BCC}.exe
{639C1E26-BF9B-48f6-82CA-3B04A07CF0CF}.exe
{67CCBA9E-18AE-467b-B35B-58F9D2403ACB}.exe
{7D1D69B4-FB58-465d-9601-68EA8FDDD117}.exe
{9324B3BE-98DB-4b73-87A8-594E3191F3BF}.exe
{AE7B7A39-4BF0-436c-88AD-1DC093437885}.exe
{B7622167-A434-4b86-A4D8-1BD1226E3651}.exe
{BD863825-8DBF-458d-A5F1-65984E948056}.exe
{CF247AB4-1881-4f38-8BAB-3B09AC508F69}.exe
{F1E83C33-9170-43b3-91E3-E248FAE85E98}.exe