stormser | c343c82fe3cbe3677eb4206c402c068ffec85b4fca68a66c74dda69ce65e1bd3

General

Target
2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe
Size 59KB
Sample261015-3cgrcses3x
SHA256 c343c82fe3cbe3677eb4206c402c068ffec85b4fca68a66c74dda69ce65e1bd3
MD5 f1997bc5c5a8598825616c3a6a3e6f27
SHA1 cbf7aa8087fb0d51a9bc9ca2728dbdc49486842b
SHA512 d96cc650465dcbf47bf231af77c6e9cd6597a6a6b8e9ea3d56f8127055fc34bff424221408e961ae716eb62bf348dd3dd0ecfcd27f74985aa3867cdf0c900940
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroK54/CFsrYAutg/CNl2e4WMZ:Mvw9816vhKQLroI4/wQLfwl27WMZ
TLSH
T1E8439D831F9A7CF2F7860075097F87B6836B59C4D24EBE9B6F90CC0D4026641E83E609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x000800000001687b-2.dat	family_stormser
behavioral1/files/0x000500000001687c-5.dat	family_stormser
behavioral1/files/0x000600000001da38-10.dat	family_stormser
behavioral1/files/0x000c00000001dabd-15.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/files/0x000800000001687b-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000500000001687c-5.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000600000001da38-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000c00000001dabd-15.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}\stubpath = "C:\\Windows\\{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe"	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0013BC52-CC00-413e-883F-1CF0BE86B53B}	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0013BC52-CC00-413e-883F-1CF0BE86B53B}\stubpath = "C:\\Windows\\{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe"	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B755F9C2-68B0-400a-A7F3-6170949E9C3F}	2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B755F9C2-68B0-400a-A7F3-6170949E9C3F}\stubpath = "C:\\Windows\\{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe"	2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{425DB06A-E06E-468b-9198-A72DCB6B7AC8}	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{425DB06A-E06E-468b-9198-A72DCB6B7AC8}\stubpath = "C:\\Windows\\{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe"	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe

Executes dropped EXE 4 IoCs

pid	Process
3436	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
3080	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
4764	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
5020	{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
File created	C:\Windows\{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
File created	C:\Windows\{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
File created	C:\Windows\{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe	2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3996	cmd.exe
4984	cmd.exe
1688	cmd.exe
4944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1168	2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	3436	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
Token: SeIncBasePriorityPrivilege	3080	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
Token: SeIncBasePriorityPrivilege	4764	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3436	1168	2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe	102
PID 1168 wrote to memory of 3996	1168	2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe	103
PID 3436 wrote to memory of 3080	3436	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe	104
PID 3436 wrote to memory of 4984	3436	{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe	105
PID 3080 wrote to memory of 4764	3080	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe	108
PID 3080 wrote to memory of 1688	3080	{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe	109
PID 4764 wrote to memory of 5020	4764	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe	111
PID 4764 wrote to memory of 4944	4764	{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-15_f1997bc5c5a8598825616c3a6a3e6f27_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
  C:\Windows\{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
    C:\Windows\{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
      C:\Windows\{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Windows\{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe
        
        C:\Windows\{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BFA29~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4944
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{425DB~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B755F~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe

Path C:\Windows\{0013BC52-CC00-413e-883F-1CF0BE86B53B}.exe
Size 59KB
SHA256 753f6d9765d8dec85abc731a71c4dec35ae9a65b022f5fdbe85934fd16d4ab0a
MD5 f4b6520b29e6afe995917c86b0abbc5c
SHA1 710d0aa24e6f25aa980da3796c1763e46d6114c7
SHA512 75c642efbbe5ff192b970a38b4a269b2880533ea8f502816a93dc096208f2bd4601cfe17b5ca000b439f1d520eb45d43c8a95c39efb884c1856b3f83cf22324b
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroKi4/CFsrYAutg/CNl2e4WMZ:Mvw9816vhKQLroH4/wQLfwl27WMZ
TLSH
T1EE439D831B9A7CF2F7860075097F8BB6836B55C4D24EBE9B6FA0CC095066641E83E609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe

Path C:\Windows\{425DB06A-E06E-468b-9198-A72DCB6B7AC8}.exe
Size 59KB
SHA256 a94868e8c3dc582aeb476375eeceee728ecc9c152ba433b16ed7fb59940e03ef
MD5 41a281a3bc982f041ad6839f29e710a0
SHA1 767591f67d039b66beb61db2f2c251e38ba102fa
SHA512 7f12424b5e74e26305ae19394cfee96983e0117d86b71ce6087f4ec085087b5954785305707038225ab4629eaafd9a1c3d68dc575591f0c23823f2991a80377d
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroKU4/CFsrYAutg/CNl2e4WMZ:Mvw9816vhKQLrox4/wQLfwl27WMZ
TLSH
T1F1439E831F9A7CF2F3861075097F97BA936B59C4D24EBE9B6F90CC0D4026641E83E609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe

Path C:\Windows\{B755F9C2-68B0-400a-A7F3-6170949E9C3F}.exe
Size 59KB
SHA256 3f888871b924bf380bd9dcb42a981bb211e4102f74df67772653ac3e35dcb43f
MD5 82fa1aad5dabff2720e1ab224af25363
SHA1 e86696eb38b5076e2b6203373db9669307ae9405
SHA512 3be95c78d079bb4df3a0bb7ffad799dcad48b2bc1e778860a8a8ed697a39b3d4fcd13a32bdad893e8ae0fdb4e607068f9eb31cc9dcb116e7db001826aee798dd
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroK64/CFsrYAutg/CNl2e4WMZ:Mvw9816vhKQLroL4/wQLfwl27WMZ
TLSH
T11A439E831F8A7CF2F3861075097F97B6836B54C4D24EBE9B6F90CC0D4026641E83E609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe

Path C:\Windows\{BFA29B3C-615B-4461-91EC-9583D2B5FFAA}.exe
Size 59KB
SHA256 ce0cb8fe48da96a0084df5dab7b0c18b120bdf35e9fbe4c3b8fa8aa8438204f9
MD5 1353420a460eeafc1e3f66957c93dbd9
SHA1 3923e9671b564501095b2368d034ec0295bf24fa
SHA512 b350052e59171193cc972ec898e6028942a71b40e1dca962b4af5358af2d3f25ef039101bde614e187cd0025b3ee692dc93c6c468331e54f8f22cd97391e4c38
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLroKc4/CFsrYAutg/CNl2e4WMZ:Mvw9816vhKQLroN4/wQLfwl27WMZ
TLSH
T192439D831F9A7CF2F3860075097F97BA836B54C4D24EBE9B6F90CC0D4026641E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads