stormser | 69fff3b5a5e8b8a93d671a03bd2a7e3fa3f0243d8386480402103ae097ffcb03

General

Target
2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe
Size 60KB
Sample261020-gseq2sv1dv
SHA256 69fff3b5a5e8b8a93d671a03bd2a7e3fa3f0243d8386480402103ae097ffcb03
MD5 80740b5df2b717806277d5afe5c821e3
SHA1 c216c58ec09b09a65236db4325ce0afd958969af
SHA512 59feb351c944e08ee4edde35a3576b0bcc47039c0c8cda44318b93312f27d40844cc1fbb0707c90988c9202f44f90b6a717fc5020b7c7adaecf6dd806be4e9ef
SSDEEP 384:NgbLwOs8AHsc4sMfwhKQLro84/CFsrdHWMZ:Ngvw9816vhKQLro84/wQpWMZ
TLSH
T16B533B830F8978F2FB810175087A8BB9966B59D4D14FFE9BBF90CC094437651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024357-2.dat	family_stormser
behavioral1/files/0x000a0000000241d3-6.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024357-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000a0000000241d3-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}	2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}\stubpath = "C:\\Windows\\{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe"	2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E85EB364-0734-40e2-8197-CDB33D897897}	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E85EB364-0734-40e2-8197-CDB33D897897}\stubpath = "C:\\Windows\\{E85EB364-0734-40e2-8197-CDB33D897897}.exe"	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe

Executes dropped EXE 2 IoCs

pid	Process
4512	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe
3024	{E85EB364-0734-40e2-8197-CDB33D897897}.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe	2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe
File created	C:\Windows\{E85EB364-0734-40e2-8197-CDB33D897897}.exe	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3808	cmd.exe
2056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E85EB364-0734-40e2-8197-CDB33D897897}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1120	2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	4512	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 4512	1120	2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe	91
PID 1120 wrote to memory of 3808	1120	2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe	92
PID 4512 wrote to memory of 3024	4512	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe	93
PID 4512 wrote to memory of 2056	4512	{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-20_80740b5df2b717806277d5afe5c821e3_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe
  C:\Windows\{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\{E85EB364-0734-40e2-8197-CDB33D897897}.exe
    C:\Windows\{E85EB364-0734-40e2-8197-CDB33D897897}.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1DA8E~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe

Path C:\Windows\{1DA8EDF7-CEEF-409d-9C6C-00A2A43C7C23}.exe
Size 60KB
SHA256 c5e3fe857ae2db683e63863ff89d31e3d0a124b06aedfebca6e775a31be7b4ff
MD5 dfc45a6cf67d74edcecebdcc82bbd40b
SHA1 29be9c0279a7abd63f2d6719aab341154b0c800e
SHA512 98d2a055ac87a5e7519c9e832119c6c9e490c6b06240ff54050bd24c783216a14e4a1028527d7a6f82c1009ff010e1e6a891f058e8af4fdf5f9820db3a3d44f1
SSDEEP 384:NgbLwOs8AHsc4sMfwhKQLro94/CFsrdHWMZ:Ngvw9816vhKQLro94/wQpWMZ
TLSH
T129533B830F8978F2FB810175087A8BB9976B59D4D15FFE9BBF90CC094436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E85EB364-0734-40e2-8197-CDB33D897897}.exe

Path C:\Windows\{E85EB364-0734-40e2-8197-CDB33D897897}.exe
Size 60KB
SHA256 d89f4b7ddda400dbcb16c04ed0ef6a33c8a3e1523f6156873bc92e700b3557a1
MD5 0d58cf8329f24ce07d883101d23144ca
SHA1 2e0618b7048f4f6000d0983b5a3d8687c09ba799
SHA512 4c6b0d9d83626c7791606d888fb7c2198527d8ebb0f364271bc73ecfe6e41364da6f95ce39a72259f42783ec0b7d954d51cda0196205c2560e258c8a7de498cf
SSDEEP 384:NgbLwOs8AHsc4sMfwhKQLro44/CFsrdHWMZ:Ngvw9816vhKQLro44/wQpWMZ
TLSH
T193534C834F897CF2FB810175087A8BB9966B59D4D14FFE9BBF90CC094436651E83E60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads