stormser | 3db25d5889a9f89debb52f407c9787e7ada93b2bee1c428c3d15fabb0c75a31e

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_e8b841d5f0fc0e2f5cd76ed4e3af48cc_elex_wannacry.exe
Size 92KB
Sample261023-e6t2sahw7v
SHA256 3db25d5889a9f89debb52f407c9787e7ada93b2bee1c428c3d15fabb0c75a31e
MD5 e8b841d5f0fc0e2f5cd76ed4e3af48cc
SHA1 657c9a8d32d9023851a71f049c0472dba273f4e9
SHA512 6d0ae9823b74196f4649fb92b89e6c16f9ffd46171bca26794fa7ea3f7bed9d2232a7790aae0a747c4a205bb03eb05740a75fd79fc89bdfad14b04fb40699de6
SSDEEP 192:ubOzawOs81elJHsc45sGcRZOgtShcWaOT2QLrCqwzY04/CFxyNhoy5tV:ubLwOs8AHsc4TMfwhKQLroV4/CFsrdV
TLSH
T1DF931B42EAD958A2FFFD023004EBCA7DD36B5984D5C9AD9B6AFBCD340026D51942B10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 2 IoCs

resource	yara_rule
behavioral1/memory/4808-0-0x0000000000400000-0x0000000000417000-memory.dmp	family_stormser
behavioral1/memory/4808-1-0x0000000000400000-0x0000000000417000-memory.dmp	family_stormser

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_e8b841d5f0fc0e2f5cd76ed4e3af48cc_elex_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_e8b841d5f0fc0e2f5cd76ed4e3af48cc_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_e8b841d5f0fc0e2f5cd76ed4e3af48cc_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-0-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4808-1-0x0000000000400000-0x0000000000417000-memory.dmp