stormser | 28b43201971978583e9f8baa8c40b2428aee722dac6b8c12f22c90f949c82e4b

General

Target
2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe
Size 60KB
Sample260924-e7x5tseb22
SHA256 28b43201971978583e9f8baa8c40b2428aee722dac6b8c12f22c90f949c82e4b
MD5 028aa95a6a0e42e014d4fb82f75da89d
SHA1 90dbcfddb22009cf44fedf295132f2b80fbd171b
SHA512 afeb091529100b2752845bf5375a2467bb9b7c5b6014465ebc705651e5441628d90341a11329055af43e9b81e7bc91d3c526b2d4d46663c033f4cf39be5efc03
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQK4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQK4/wQTGaWhj8s
TLSH
T141537D836BEA2CF2F6F11232057859B4D22B99D4A15DBEDBBB80CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000243d8-2.dat	family_stormser
behavioral1/files/0x00110000000243da-6.dat	family_stormser
behavioral1/files/0x0007000000022ae4-8.dat	family_stormser
behavioral1/files/0x00120000000243da-14.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}	2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}\stubpath = "C:\\Windows\\{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe"	2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}\stubpath = "C:\\Windows\\{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe"	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65181026-6863-4c2c-ABC8-CF055FA0184F}	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{65181026-6863-4c2c-ABC8-CF055FA0184F}\stubpath = "C:\\Windows\\{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe"	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36BD993F-F4A6-4979-8F20-A973EA45F54F}	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{36BD993F-F4A6-4979-8F20-A973EA45F54F}\stubpath = "C:\\Windows\\{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe"	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe

Executes dropped EXE 4 IoCs

pid	Process
2484	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
2316	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
4560	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe
220	{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe	2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe
File created	C:\Windows\{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
File created	C:\Windows\{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
File created	C:\Windows\{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5980	cmd.exe
2528	cmd.exe
1704	cmd.exe
2564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5072	2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2484	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
Token: SeIncBasePriorityPrivilege	2316	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
Token: SeIncBasePriorityPrivilege	4560	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 2484	5072	2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe	101
PID 5072 wrote to memory of 5980	5072	2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe	102
PID 2484 wrote to memory of 2316	2484	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe	103
PID 2484 wrote to memory of 2528	2484	{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe	104
PID 2316 wrote to memory of 4560	2316	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe	109
PID 2316 wrote to memory of 1704	2316	{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe	110
PID 4560 wrote to memory of 220	4560	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe	111
PID 4560 wrote to memory of 2564	4560	{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_028aa95a6a0e42e014d4fb82f75da89d_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
  C:\Windows\{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
    C:\Windows\{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe
      C:\Windows\{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe
        
        C:\Windows\{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:220
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{65181~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2564
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{AEAE6~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{2D10C~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe

Path C:\Windows\{2D10CDEA-3DD2-412d-9A14-E4D9ABDBAB42}.exe
Size 60KB
SHA256 c3be25ad3ea283a77990054a54dff60668f6acd1582fda15c790bd55f97c5f58
MD5 37687996020e1773eda5f6ca8e5d946c
SHA1 374598d1e827641ab3be9ee92706a5c9680eff3c
SHA512 5fe75c99cb7c914a507201448d2ad1d2dc531509d130d1cc4689ef8780657b89d32c34dde2b0adae20fa09d5b7d4fcd56ece0faa3ce1f35462ca1d7901fd618a
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQm4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQm4/wQTGaWhj8s
TLSH
T19D538C835BEA2CF2F2F10232057849B5D22B99D5A15CBEDBBB80CE1604372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe

Path C:\Windows\{36BD993F-F4A6-4979-8F20-A973EA45F54F}.exe
Size 60KB
SHA256 75facf185edad79a252dd8648f4ddbb68e4eac9d5d3e3ef04ab78f34830e2408
MD5 e84dc963d59b7a01ca271d6aabfc4e04
SHA1 c824e6cf4edbf618a37a7a949ce1cb314af1adfe
SHA512 e3e4aacf5ed120136e850b7217b69bb06855277b39a5ac258e7612641ba2309d473dfc1b5d47d96ad1eb69da025ac7c6c8e18d97d28871d995b20b71111ecd12
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQl4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQl4/wQTGaWhj8s
TLSH
T115537D835BEA2CF2F6F1023205785AB4D22B9AD4615DBEDBBB80CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe

Path C:\Windows\{65181026-6863-4c2c-ABC8-CF055FA0184F}.exe
Size 60KB
SHA256 5ba3c961c333c103adab0a783eebf2157d418792ad19d97ebebbd83abecf1516
MD5 8aa4a858fd95df40351fe4148235d5b9
SHA1 227b38502b1f10d24fcb605ae32e8fff08ff7efa
SHA512 66b90cb969166033aa6aa38d326d7dbdaefbef8f4910f80f040ceee0dc492a52a68fb02b8266e4299117d5a5392d6141ed6caebf357e357b36e3116246c21062
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQi4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQi4/wQTGaWhj8s
TLSH
T16B537C836BEA2CF2F6F10232057859B4D22B9AD4A15DBEDBBB90CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe

Path C:\Windows\{AEAE670F-A10E-4083-AC98-8F899D0A1C5E}.exe
Size 60KB
SHA256 97cb2c9331c0a653c41124b7feb7975f52d9f11fd77808e41a868a1baf967120
MD5 c8bfa6be6d6009e8b521b0eb47cd6658
SHA1 2b5246b26b93f3acc3580575c66b64c394d02a9b
SHA512 fd490fe7487a87ad4ae9d73c06dd985f24d78f19bdde1bd8ca8f2e9457ee23402b72847db7cc2385776671ad26c3aa16d8c1e68d4cfc35d61a4a6b49d779b2de
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroomaQEX4/CFsrFJGlMlrWg6j8s:vvw9816vhKQLroLaQY4/wQTGaWhj8s
TLSH
T14D537C836BEA2CF2F6F10232057859B5D22B9AD4A15DBEDBBB80CE1504372C1D53F10A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads