stormser | 1cc38dbdc46362acd028e010da58d7669eec0b87ef42bedb44fe8aafb7a083be

General

Target
2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe
Size 60KB
Sample260928-3e6hhawbqb
SHA256 1cc38dbdc46362acd028e010da58d7669eec0b87ef42bedb44fe8aafb7a083be
MD5 dec106853e00396b820ba6d7d7b61fc3
SHA1 b35185abf75c8abf5a0d8af4664f2705f912358f
SHA512 272a357ca5352a2455139cb609ae832e81c61c5947b8967fb52d42e8b0f6c07680491d1fd2ba9f3e1ef81a36304df7b2ca509ef46cad42469c17d76f7d2dad75
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwPY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroh4/CFsrd
TLSH
T1535308834BEE5CF2F791117108798AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x0009000000024424-2.dat	family_stormser
behavioral1/files/0x000300000001dbe8-6.dat	family_stormser
behavioral1/files/0x000a000000024437-8.dat	family_stormser
behavioral1/files/0x000400000001dbe8-14.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}\stubpath = "C:\\Windows\\{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe"	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD92137D-6E85-4286-B17E-5ED975509388}	2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AD92137D-6E85-4286-B17E-5ED975509388}\stubpath = "C:\\Windows\\{AD92137D-6E85-4286-B17E-5ED975509388}.exe"	2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{816C1062-595D-4221-9913-3FAD96B1881B}	{AD92137D-6E85-4286-B17E-5ED975509388}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{816C1062-595D-4221-9913-3FAD96B1881B}\stubpath = "C:\\Windows\\{816C1062-595D-4221-9913-3FAD96B1881B}.exe"	{AD92137D-6E85-4286-B17E-5ED975509388}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30BC9CFC-1615-4c1f-8581-BE5A9343124A}	{816C1062-595D-4221-9913-3FAD96B1881B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{30BC9CFC-1615-4c1f-8581-BE5A9343124A}\stubpath = "C:\\Windows\\{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe"	{816C1062-595D-4221-9913-3FAD96B1881B}.exe

Executes dropped EXE 4 IoCs

pid	Process
716	{AD92137D-6E85-4286-B17E-5ED975509388}.exe
972	{816C1062-595D-4221-9913-3FAD96B1881B}.exe
4204	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe
2024	{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{AD92137D-6E85-4286-B17E-5ED975509388}.exe	2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe
File created	C:\Windows\{816C1062-595D-4221-9913-3FAD96B1881B}.exe	{AD92137D-6E85-4286-B17E-5ED975509388}.exe
File created	C:\Windows\{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe	{816C1062-595D-4221-9913-3FAD96B1881B}.exe
File created	C:\Windows\{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4736	cmd.exe
4924	cmd.exe
2980	cmd.exe
4220	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{816C1062-595D-4221-9913-3FAD96B1881B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AD92137D-6E85-4286-B17E-5ED975509388}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3016	2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	716	{AD92137D-6E85-4286-B17E-5ED975509388}.exe
Token: SeIncBasePriorityPrivilege	972	{816C1062-595D-4221-9913-3FAD96B1881B}.exe
Token: SeIncBasePriorityPrivilege	4204	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 716	3016	2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe	99
PID 3016 wrote to memory of 4924	3016	2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe	100
PID 716 wrote to memory of 972	716	{AD92137D-6E85-4286-B17E-5ED975509388}.exe	101
PID 716 wrote to memory of 2980	716	{AD92137D-6E85-4286-B17E-5ED975509388}.exe	102
PID 972 wrote to memory of 4204	972	{816C1062-595D-4221-9913-3FAD96B1881B}.exe	106
PID 972 wrote to memory of 4220	972	{816C1062-595D-4221-9913-3FAD96B1881B}.exe	107
PID 4204 wrote to memory of 2024	4204	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe	108
PID 4204 wrote to memory of 4736	4204	{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_dec106853e00396b820ba6d7d7b61fc3_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\{AD92137D-6E85-4286-B17E-5ED975509388}.exe
  C:\Windows\{AD92137D-6E85-4286-B17E-5ED975509388}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\{816C1062-595D-4221-9913-3FAD96B1881B}.exe
    C:\Windows\{816C1062-595D-4221-9913-3FAD96B1881B}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe
      C:\Windows\{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\Windows\{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe
        
        C:\Windows\{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2024
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{30BC9~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{816C1~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{AD921~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe

Path C:\Windows\{30BC9CFC-1615-4c1f-8581-BE5A9343124A}.exe
Size 60KB
SHA256 5a16f8fda562c7205dbf8bf7476da99816f3a7180143e7bb1751fc32383224d2
MD5 1b5df1602a6711b26e8fd7bbdc8fee2b
SHA1 f7aca470bdbdfd62959be5b25d4e582549dfccb4
SHA512 913836e8b225fbe8cd9d3569232441552e824c062bc5340a83b5feeb37c41de473f57102318f022f80a7d40cc1c9729fc44ca8991f27735312ed75f04a99bec6
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwAY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroO4/CFsrd
TLSH
T1605308834BDE5CF2F791113108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{816C1062-595D-4221-9913-3FAD96B1881B}.exe

Path C:\Windows\{816C1062-595D-4221-9913-3FAD96B1881B}.exe
Size 60KB
SHA256 07d964ecf05372e7db23ed3fb63a73cd2b63f49ff9bedf36638342ebf19c633c
MD5 ac9a6e0b66b3a041e7be7dd681b2cbf2
SHA1 5a1dd48c00b9512d84e9496c8ef494fd6097ac64
SHA512 744ec8b1487dad37349146bd3194b0c2bd8c9e9664fe86293b270062d8b0c2590d26af327dde4f70f6a9e89768d684aa53af3af1ae42f653a5922fd80a56ff40
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwAY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroO4/CFsrd
TLSH
T1B353F8835BEE5CF2F691113108798AB9927BA9C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe

Path C:\Windows\{AA5E2013-5DD9-49be-BDE9-BDB00DF938B8}.exe
Size 60KB
SHA256 d26c9dff3bfeefef07c7a088724e81ac89a148fbd762c07ba3988c3da5e23c2a
MD5 829b20a1ff59817c46c929248b3b4cca
SHA1 42e4edcc3dfac5c42f9a483019ec5f9b2d797855
SHA512 cb5bbcdae896245c69d6c80ff8dc44431576d0662f050f05f6d14e032e8e2efb95c275da6f332c8add7123df0d568f73c7f986490a96dd534f89dc5de21f6c7d
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwKY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrog4/CFsrd
TLSH
T1F75309834BEE5CF2F791123108794AB9927B99C4950DBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{AD92137D-6E85-4286-B17E-5ED975509388}.exe

Path C:\Windows\{AD92137D-6E85-4286-B17E-5ED975509388}.exe
Size 60KB
SHA256 45b497758564ea71b1842df4d14695329065b927b09fcba428788f603c27a443
MD5 8ecb7aec60bb850d7f81069583f98f2b
SHA1 816e5579a425c55f87b8cc1f28c4d6b01f1383ff
SHA512 1cefcb291f7af21575ecb21dd63c8bd673229295583369b568b084e04ff4dd1432995beeed7e8ec131168617c26c907a53ff27dad28eeec9253039025bc8fa22
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwoxY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrooD4/CFsrd
TLSH
T1155308834BDE5CF2F791123108798AB9927B99D4910EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads