stormser | b5648514bc8fad7177039f0437153134239113c81eb5cbcdf868fc16146d2a35

General

Target
2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe
Size 76KB
Sample261011-h3c6msgv6w
SHA256 b5648514bc8fad7177039f0437153134239113c81eb5cbcdf868fc16146d2a35
MD5 9dfc9223c0a736e61ed1e28e4482978e
SHA1 72d1d1240134acd89921e2a7069a29f161115d05
SHA512 40fe1a45e0425046fb33bf4f9633aaeb0c1880896cae10cb7eed44ad0c9a775e188fdd2909eb75a25e74ebd7730d4322f50b41ac056c17cf07c58f2c6bdec3de
SSDEEP 768:vvw9816vhKQLroG/4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:nEGh0oG/lwWMZQcpmgDagIyS1loL7Wr
TLSH
T127735B02A684B5F2EBAC0134B19F0F7E963796B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x000700000002445a-3.dat	family_stormser
behavioral1/files/0x0008000000024449-7.dat	family_stormser
behavioral1/files/0x000a0000000241e7-10.dat	family_stormser
behavioral1/files/0x00050000000006f1-17.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/files/0x000700000002445a-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024449-7.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000a0000000241e7-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00050000000006f1-17.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7963C35B-AC36-47d5-9A8A-59824241D2BA}	2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7963C35B-AC36-47d5-9A8A-59824241D2BA}\stubpath = "C:\\Windows\\{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe"	2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}	{FB14886F-9366-4c3f-B2AD-593A07858604}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}\stubpath = "C:\\Windows\\{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe"	{FB14886F-9366-4c3f-B2AD-593A07858604}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{093759F3-2E14-422d-949B-06525FA12E3B}	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{093759F3-2E14-422d-949B-06525FA12E3B}\stubpath = "C:\\Windows\\{093759F3-2E14-422d-949B-06525FA12E3B}.exe"	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB14886F-9366-4c3f-B2AD-593A07858604}	{093759F3-2E14-422d-949B-06525FA12E3B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FB14886F-9366-4c3f-B2AD-593A07858604}\stubpath = "C:\\Windows\\{FB14886F-9366-4c3f-B2AD-593A07858604}.exe"	{093759F3-2E14-422d-949B-06525FA12E3B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}	{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}\stubpath = "C:\\Windows\\{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe"	{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe

Executes dropped EXE 4 IoCs

pid	Process
4044	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe
2228	{093759F3-2E14-422d-949B-06525FA12E3B}.exe
1592	{FB14886F-9366-4c3f-B2AD-593A07858604}.exe
1716	{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{FB14886F-9366-4c3f-B2AD-593A07858604}.exe	{093759F3-2E14-422d-949B-06525FA12E3B}.exe
File created	C:\Windows\{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe	{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe
File created	C:\Windows\{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe	2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe
File created	C:\Windows\{093759F3-2E14-422d-949B-06525FA12E3B}.exe	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3984	cmd.exe
4148	cmd.exe
4184	cmd.exe
3236	cmd.exe
2768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FB14886F-9366-4c3f-B2AD-593A07858604}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{093759F3-2E14-422d-949B-06525FA12E3B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3496	2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	4044	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe
Token: SeIncBasePriorityPrivilege	2228	{093759F3-2E14-422d-949B-06525FA12E3B}.exe
Token: SeIncBasePriorityPrivilege	404	{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4044	3496	2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe	96
PID 3496 wrote to memory of 3984	3496	2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe	97
PID 4044 wrote to memory of 2228	4044	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe	98
PID 4044 wrote to memory of 4148	4044	{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe	99
PID 2228 wrote to memory of 1592	2228	{093759F3-2E14-422d-949B-06525FA12E3B}.exe	108
PID 2228 wrote to memory of 4184	2228	{093759F3-2E14-422d-949B-06525FA12E3B}.exe	109
PID 404 wrote to memory of 1716	404	{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe	112
PID 404 wrote to memory of 2768	404	{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_9dfc9223c0a736e61ed1e28e4482978e_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe
  C:\Windows\{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\{093759F3-2E14-422d-949B-06525FA12E3B}.exe
    C:\Windows\{093759F3-2E14-422d-949B-06525FA12E3B}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\{FB14886F-9366-4c3f-B2AD-593A07858604}.exe
      C:\Windows\{FB14886F-9366-4c3f-B2AD-593A07858604}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1592
    - - C:\Windows\{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe
        
        C:\Windows\{2EA4F1DB-CA2A-4bb0-A774-AA2236CA64FB}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:404
      - C:\Windows\{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe
        
        C:\Windows\{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1716
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2EA4F~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2768
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FB148~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3236
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{09375~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4184
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7963C~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{093759F3-2E14-422d-949B-06525FA12E3B}.exe

Path C:\Windows\{093759F3-2E14-422d-949B-06525FA12E3B}.exe
Size 76KB
SHA256 4bfce142d87df32aad63006944536a17e9990791ba7dfd8a98759b64fdfb0ef3
MD5 0d4df2ec9737322bc5af0809b702b0f2
SHA1 93296768b20e4a219641bdec7a6cccbc2ebd9333
SHA512 650f6a3c220cda863d5929fe4652540cf10e6157ada6205f3c40d3f1de7a24daddb39c6f2474b9d7c8c54a02cb2788fbcce8791a74eb1b46ac7d301d38bf3636
SSDEEP 768:vvw9816vhKQLroo/4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:nEGh0oo/lwWMZQcpmgDagIyS1loL7Wr
TLSH
T19B735B02A684B5F2EBAC0134B19F0FBE963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe

Path C:\Windows\{3144F0C9-60AB-41fb-9831-887B5FEF2A0C}.exe
Size 76KB
SHA256 92ff7d6851ecc5ac3482c1cb9e4cd85e99157ed59113cc639daf740ff823a61d
MD5 2db78bfe7d7dc26fa481317f6ed99ead
SHA1 02125461f1b5fbbe1ae36c43ceb1e547491d8136
SHA512 ab04a53536414459474b07b677a90fd229f35eb89f9b973b6976d57a77972e6cbbe737f076863f649d43b46a32bb8b3f9eb9c75286d2ceaa6bb865e708c8620c
SSDEEP 768:vvw9816vhKQLroO/4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:nEGh0oO/lwWMZQcpmgDagIyS1loL7Wr
TLSH
T1D8735B02A684B5F2EBAC0134B19F0F7E963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe

Path C:\Windows\{7963C35B-AC36-47d5-9A8A-59824241D2BA}.exe
Size 76KB
SHA256 7fc4bb7e47e45cfbc58787248a42aa9c5fa918c7ca1a1b0fa717ca1159230136
MD5 03864250e386307b5f7cae42b98da586
SHA1 e8a36b161e94d52f32ffe21208142d13e463417c
SHA512 2e218765df15345329c26928b113c479bd8cd6179e966fd2a1c0017aeb6b428842e9f92373c80df977f749df20480259bdfef351d1c4da2ae66295d856a3c734
SSDEEP 768:vvw9816vhKQLros/4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:nEGh0os/lwWMZQcpmgDagIyS1loL7Wr
TLSH
T1A8735B02A684B5F2EBAC0134B19F0F7E963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FB14886F-9366-4c3f-B2AD-593A07858604}.exe

Path C:\Windows\{FB14886F-9366-4c3f-B2AD-593A07858604}.exe
Size 76KB
SHA256 9f9ef9e108be70e1e6c0740246bb3dcfcf89b66a2e0263ad1d24376f052183a2
MD5 3a9f5bd31547faf9258e8f90d9f68d22
SHA1 9faccc473296bde45f6db9b6b71a73f14cce6bcd
SHA512 e212e5cf0e10d6729c22c42f7bc0cf38cdd824c9d3c040b3b9a02b2c5c2fbd4783ca943cf6c73d2f1b1583e0f636a4c7f4b697cbd8d4b868a95982fc880166e3
SSDEEP 768:vvw9816vhKQLro6/4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVd:nEGh0o6/lwWMZQcpmgDagIyS1loL7Wr
TLSH
T14E735B02A684B5F2EBAC0134B19F0F7E963795B1C0D9682F6F634DA55862C63F431E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads