stormser | 3cbd847262d29ca9d193df4489eb0774896b2497ad04c6e5195d44ef4c65bc7d

General

Target
2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe
Size 60KB
Sample261014-tk74vaey4l
SHA256 3cbd847262d29ca9d193df4489eb0774896b2497ad04c6e5195d44ef4c65bc7d
MD5 9a3bf5151083beb2e67408b4ce1b7c60
SHA1 685316cda18954a809bbfb8a7451d0095fd9adeb
SHA512 70a42d64ba6370363e1063f1e07861b1e2dc43fd8eceefd4a66deae2195318a66ae9f10f65792652450ac6c372f7edd878a36257cabb2217fe2c83d24a0c4812
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwiY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroY4/CFsrd
TLSH
T16253F8834BDE5CF2F791113108798AB9927B9AC4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x001200000001daea-2.dat	family_stormser
behavioral1/files/0x000c00000001daec-5.dat	family_stormser
behavioral1/files/0x000400000001e10a-10.dat	family_stormser
behavioral1/files/0x000700000001e6d4-14.dat	family_stormser
behavioral1/files/0x000500000001e10a-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E2C3868-1178-4c15-9D05-D40150C64C1E}	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37F56DB5-E0F7-4dca-8A7A-211636D2D987}	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{37F56DB5-E0F7-4dca-8A7A-211636D2D987}\stubpath = "C:\\Windows\\{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe"	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}	2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}\stubpath = "C:\\Windows\\{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe"	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3E2C3868-1178-4c15-9D05-D40150C64C1E}\stubpath = "C:\\Windows\\{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe"	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E25CF4F-8875-4d01-93D0-DACE33340F11}	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8E25CF4F-8875-4d01-93D0-DACE33340F11}\stubpath = "C:\\Windows\\{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe"	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}\stubpath = "C:\\Windows\\{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe"	2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe

Executes dropped EXE 5 IoCs

pid	Process
3064	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
4032	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
2400	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
2292	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe
3784	{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe	2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe
File created	C:\Windows\{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
File created	C:\Windows\{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
File created	C:\Windows\{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
File created	C:\Windows\{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe
3788	cmd.exe
4192	cmd.exe
3340	cmd.exe
4776	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	456	2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3064	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
Token: SeIncBasePriorityPrivilege	4032	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
Token: SeIncBasePriorityPrivilege	2400	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
Token: SeIncBasePriorityPrivilege	2292	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 3064	456	2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe	97
PID 456 wrote to memory of 4192	456	2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe	98
PID 3064 wrote to memory of 4032	3064	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe	99
PID 3064 wrote to memory of 3340	3064	{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe	100
PID 4032 wrote to memory of 2400	4032	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe	104
PID 4032 wrote to memory of 4776	4032	{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe	105
PID 2400 wrote to memory of 2292	2400	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe	114
PID 2400 wrote to memory of 4328	2400	{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe	115
PID 2292 wrote to memory of 3784	2292	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe	117
PID 2292 wrote to memory of 3788	2292	{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_9a3bf5151083beb2e67408b4ce1b7c60_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
  C:\Windows\{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
    C:\Windows\{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - C:\Windows\{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
      C:\Windows\{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Windows\{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe
        
        C:\Windows\{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2292
      - C:\Windows\{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe
        
        C:\Windows\{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3784
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{8E25C~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3788
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3E2C3~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5DDAD~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CAEAE~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe

Path C:\Windows\{37F56DB5-E0F7-4dca-8A7A-211636D2D987}.exe
Size 60KB
SHA256 0418f5db1ace036b65a75dcdab96e21f291f3e8191eaf0e24904b288c8ab2dd7
MD5 36a8c0ba519f49f6a38382530f165a9f
SHA1 e0b4c2cc3d7764783bd64dee43cd36c43391d383
SHA512 6499e357992532022e7ff7a08519c0fa411891606c483f4ad173339262d0bb53d9aadc96aca31180347ceda29b4ff3affde0bd0d57a87ad4ae1991924810177a
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwadY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroaP4/CFsrd
TLSH
T1D35308834BDE9CF2F791113108798AB9927B99C4910EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe

Path C:\Windows\{3E2C3868-1178-4c15-9D05-D40150C64C1E}.exe
Size 60KB
SHA256 04ca05907e10e9e41f8b057b6a928ef1d6484c2ac7841ff4b5f2371542dd412d
MD5 f266d35b1c49e802634e7ead6f431c65
SHA1 8df14fdee467089e0129f082c727a87813e59604
SHA512 d3e3efd94d4748623021049c6368d0774b89f49f498f746d1fc05f853ee56fec9389c5dd32fd9ea455ab04bbaee45a6e87094b231206cdbf52dc4bd2d77ff5d4
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwcY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroq4/CFsrd
TLSH
T1D05308834BDE9CF2F791113108798AB9927BA9C4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe

Path C:\Windows\{5DDADAB5-3EA8-419c-A71E-778765DF8EB2}.exe
Size 60KB
SHA256 a2c12251b1795b8acb164c3e2f16a44af9e89852c0db65f1cfb0dbf785c23368
MD5 4bf05652c1b83c75736cc662294387e3
SHA1 e4f318e149fc45f3352852f53be4d7982f6f05ba
SHA512 7d49a06c1ffa315f79e4dda53d7fc0b7711f9af0cdc92aef650d80a6db70a5546b840f1f21a355f3cf98ff960857ee376159dbabe2c28375d26a0697a74084e1
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwjY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrol4/CFsrd
TLSH
T19F5308834BEE5CF2F791113108798AB9927B9AC4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe

Path C:\Windows\{8E25CF4F-8875-4d01-93D0-DACE33340F11}.exe
Size 60KB
SHA256 5dfb26909ffcfa64f8ad196b6ed197a7a734ee0f7c6261332f25ec564829662b
MD5 5df2508ba94fc526e78137be5db7adc2
SHA1 35785ef35f2942ce0af9d48199f103ab4cd1767e
SHA512 18dfd74179ca9232afe22899b19edcd5a3a905fd81ebeea5cf47b7ecdbff92222b7d34d3d34f38662cd629a1169b749da24e1266d5a070cc83f2a64a442ee43e
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwYY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroG4/CFsrd
TLSH
T1E85309834BDE9CF2F791123108798AB9927B99C4950EBEDFBF90CD554037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe

Path C:\Windows\{CAEAE9C6-BE1A-411d-BDF9-729C5C655A64}.exe
Size 60KB
SHA256 770434b22789967b15d4151271f1ec19fbba672ff1eba3bc8d323e8697a8183f
MD5 b1e38a88b35cda27d154c3e078145d8d
SHA1 ace770a88809cc39b5efdd02f9e9499ed76af088
SHA512 8e0ba418de33c85b994c20b06658b730d7b4c9e681ad698e7f70e403405821407e4f71f144dadc51cbde5f3833058797275407012b5a1405660edf7fc2448498
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwtY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro/4/CFsrd
TLSH
T16753F8834BDE5CF2F791123118798BB9927B99C4950EBEDFBB90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads