stormser | 8abbae37abbbe5cc8fda9915b447dd97a673c03803c78b55a714ef6f9a5de757

General

Target
2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe
Size 60KB
Sample261024-13ch8aev5k
SHA256 8abbae37abbbe5cc8fda9915b447dd97a673c03803c78b55a714ef6f9a5de757
MD5 0b2bd81b14bad377399cb78ef1bf3a38
SHA1 0a73cf82655f53856865c1124da5ccca5caf7df6
SHA512 02c4bf4afaba372e5cbeecdafc088c854589abd45ecc17e9c7fb3c473ac3a68096f3e595ee73298bae614c0fbee274846596b6c886f506da1ce6040639affb46
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwE/Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroo4/CFsrd
TLSH
T19853F8834BDE5CF2F791113108798AB9927B99C4950EBEDFBB90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 8 IoCs

resource	yara_rule
behavioral1/files/0x000700000002446f-2.dat	family_stormser
behavioral1/files/0x0008000000024460-7.dat	family_stormser
behavioral1/files/0x0008000000024477-10.dat	family_stormser
behavioral1/files/0x0009000000024460-14.dat	family_stormser
behavioral1/files/0x00050000000006d3-18.dat	family_stormser
behavioral1/files/0x00030000000006d5-22.dat	family_stormser
behavioral1/files/0x00060000000006d3-27.dat	family_stormser
behavioral1/files/0x00040000000006d5-30.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12AB3512-0392-421d-AD55-957412301AE8}\stubpath = "C:\\Windows\\{12AB3512-0392-421d-AD55-957412301AE8}.exe"	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54027CDE-0D41-4a7a-B357-BC5483CF2551}	{12AB3512-0392-421d-AD55-957412301AE8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{54027CDE-0D41-4a7a-B357-BC5483CF2551}\stubpath = "C:\\Windows\\{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe"	{12AB3512-0392-421d-AD55-957412301AE8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}\stubpath = "C:\\Windows\\{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe"	2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE28B864-AD26-48cf-885A-3E9A041D0184}\stubpath = "C:\\Windows\\{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe"	{F473C158-8A80-4b49-A807-572C597C80FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{12AB3512-0392-421d-AD55-957412301AE8}	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}\stubpath = "C:\\Windows\\{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe"	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}	2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F473C158-8A80-4b49-A807-572C597C80FA}	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{990FF369-3EB0-40c0-B857-A6230C6F74D8}	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DE28B864-AD26-48cf-885A-3E9A041D0184}	{F473C158-8A80-4b49-A807-572C597C80FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}\stubpath = "C:\\Windows\\{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe"	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F473C158-8A80-4b49-A807-572C597C80FA}\stubpath = "C:\\Windows\\{F473C158-8A80-4b49-A807-572C597C80FA}.exe"	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{990FF369-3EB0-40c0-B857-A6230C6F74D8}\stubpath = "C:\\Windows\\{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe"	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe

Executes dropped EXE 8 IoCs

pid	Process
4988	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
4704	{F473C158-8A80-4b49-A807-572C597C80FA}.exe
204	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe
2368	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
1284	{12AB3512-0392-421d-AD55-957412301AE8}.exe
4680	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
5028	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
884	{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe	{12AB3512-0392-421d-AD55-957412301AE8}.exe
File created	C:\Windows\{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
File created	C:\Windows\{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
File created	C:\Windows\{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe	2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe
File created	C:\Windows\{F473C158-8A80-4b49-A807-572C597C80FA}.exe	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
File created	C:\Windows\{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe	{F473C158-8A80-4b49-A807-572C597C80FA}.exe
File created	C:\Windows\{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe
File created	C:\Windows\{12AB3512-0392-421d-AD55-957412301AE8}.exe	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4184	cmd.exe
692	cmd.exe
1480	cmd.exe
220	cmd.exe
2240	cmd.exe
404	cmd.exe
3556	cmd.exe
4888	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{12AB3512-0392-421d-AD55-957412301AE8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F473C158-8A80-4b49-A807-572C597C80FA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1500	2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4988	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
Token: SeIncBasePriorityPrivilege	4704	{F473C158-8A80-4b49-A807-572C597C80FA}.exe
Token: SeIncBasePriorityPrivilege	204	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe
Token: SeIncBasePriorityPrivilege	2368	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
Token: SeIncBasePriorityPrivilege	1284	{12AB3512-0392-421d-AD55-957412301AE8}.exe
Token: SeIncBasePriorityPrivilege	4680	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
Token: SeIncBasePriorityPrivilege	5028	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 4988	1500	2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe	92
PID 1500 wrote to memory of 692	1500	2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe	93
PID 4988 wrote to memory of 4704	4988	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe	94
PID 4988 wrote to memory of 1480	4988	{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe	95
PID 4704 wrote to memory of 204	4704	{F473C158-8A80-4b49-A807-572C597C80FA}.exe	98
PID 4704 wrote to memory of 220	4704	{F473C158-8A80-4b49-A807-572C597C80FA}.exe	99
PID 204 wrote to memory of 2368	204	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe	100
PID 204 wrote to memory of 2240	204	{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe	101
PID 2368 wrote to memory of 1284	2368	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe	102
PID 2368 wrote to memory of 404	2368	{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe	103
PID 1284 wrote to memory of 4680	1284	{12AB3512-0392-421d-AD55-957412301AE8}.exe	104
PID 1284 wrote to memory of 3556	1284	{12AB3512-0392-421d-AD55-957412301AE8}.exe	105
PID 4680 wrote to memory of 5028	4680	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe	106
PID 4680 wrote to memory of 4888	4680	{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe	107
PID 5028 wrote to memory of 884	5028	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe	108
PID 5028 wrote to memory of 4184	5028	{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0b2bd81b14bad377399cb78ef1bf3a38_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Windows\{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
  C:\Windows\{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\{F473C158-8A80-4b49-A807-572C597C80FA}.exe
    C:\Windows\{F473C158-8A80-4b49-A807-572C597C80FA}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe
      C:\Windows\{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\Windows\{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
        
        C:\Windows\{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2368
      - C:\Windows\{12AB3512-0392-421d-AD55-957412301AE8}.exe
        
        C:\Windows\{12AB3512-0392-421d-AD55-957412301AE8}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Windows\{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
        
        C:\Windows\{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4680
        
        C:\Windows\{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
        
        C:\Windows\{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe
        
        C:\Windows\{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{D8538~1.EXE > nul
        9⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4184
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{54027~1.EXE > nul
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{12AB3~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3556
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{990FF~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{DE28B~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2240
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F473C~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{04E9F~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe

Path C:\Windows\{04E9FD13-9BA8-4be0-BF7C-CC3E6E741DF6}.exe
Size 60KB
SHA256 221389d1fc733c93898a53919cbc41ad17485e77ef4746d61ef09f255381f032
MD5 34b81469ae8ece8b9ebd789d37bed49c
SHA1 ea935db7f7a6fdce210df8d5aed21318d43e50bc
SHA512 4ab3a77b21500e6e920e931cf4956d8511d17a57b824c41eeae62a0d28fb8559a5f4493dd99e2fe3f4bbec021ec6587223f55124f80981521eaec2bc76643788
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwiY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroY4/CFsrd
TLSH
T1DD5308834BDE5CF2F6911131087D8AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{12AB3512-0392-421d-AD55-957412301AE8}.exe

Path C:\Windows\{12AB3512-0392-421d-AD55-957412301AE8}.exe
Size 60KB
SHA256 8a743d6d683a02fbfdaeab0a8d8445b78221bd2bbe7721303875b86eae6e712b
MD5 242dfcdb8871fa77fc8cafbff6adf0c6
SHA1 2156040fe80168e4b01cf03f976a1f0279821b66
SHA512 327040e0bc6d7d93141346759efee970d828d1d462c07b6e56eb7c180b9df0511dd2248bfe966290c88b3314c4bda4dcd90f95d510d8ddd1ca781adaff80dcd2
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwDfY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrod4/CFsrd
TLSH
T1225308834BEE5CF2F791123108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe

Path C:\Windows\{2EC83B81-CFA9-4a4d-9684-AF51977D06E2}.exe
Size 60KB
SHA256 5164bf938246fd61760d1e4ebf714c2715d48c86e97609ed9d360097e80e67ed
MD5 68115694d299ab207525aadc35d23181
SHA1 09ee434e2a4f39d3f3a5e0bb4aeb61b9c16bb230
SHA512 b9faac62853b178504e8e5b886cb005717c9ef6719ef55a0fe363ec21ef747f7c3318df9d1296424743fbe44f592bfc32a014ccaf4f19612b3d9a5de2fb299c2
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEZY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro64/CFsrd
TLSH
T1AA53F8834BEE9CF2F791127108794AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe

Path C:\Windows\{54027CDE-0D41-4a7a-B357-BC5483CF2551}.exe
Size 60KB
SHA256 30e69ce3c21ac511df7355ca2d3feb4f31847c04e802383fa407ae8c9ff8e732
MD5 a637a98243db15a52496875ed6684280
SHA1 7134fc4b062983957a4fa113006c1530a8283c1a
SHA512 80ecaf1628b1beea8d888f6a4821eedbaeccc3786051de67b73b8fe9dcc3f55dc4abcadacba61dc711da6a52a1b77a4a9fa190f2046501f675af90ba8d3d029d
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwwY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroe4/CFsrd
TLSH
T18253F8834BDE5CF2F691117108798BB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe

Path C:\Windows\{990FF369-3EB0-40c0-B857-A6230C6F74D8}.exe
Size 60KB
SHA256 1647a5adcfe03e030b639c5f2a464f1b9b49904ffeed3006aefdbfde8dca2aa9
MD5 8f628a54cd402187907f0833c202a13e
SHA1 e97c26a444b3d3abc4c8fda755dc2e01827cb17b
SHA512 c035b5337b2dc18b1b6e5fcb253d9afc8a4c65999ad49d4aba196214a20a4e5133064aed0252895b93aa1d7965d36cb8a15e864672b9e262c877f8621dbe7f59
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwBY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroz4/CFsrd
TLSH
T1695308834BEE5CF2F791123108798AB9927B99C4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe

Path C:\Windows\{D8538FFB-FBCB-4682-9D1F-C1ED07E4259F}.exe
Size 60KB
SHA256 8493270ba30e2c6fe3918bc01f1b0d9d1f22e404f692a8bbb56901640b3a5548
MD5 4d0b1a11e88bd2f6c076fdee14c37fce
SHA1 7b9c8663275c01cfdf2331381a9e802525e751ee
SHA512 be81158aadc19a747ff549b53c6bb2f4f920aad546d25dd7b0553b3563b44c7b6ad4ba2549fedb32e4a51e1de360bab3a37775ee991d6f0e3b0be9028c2d2443
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwQY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro+4/CFsrd
TLSH
T1E85308834BEE9CF2F791117108798AB9927B99C4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe

Path C:\Windows\{DE28B864-AD26-48cf-885A-3E9A041D0184}.exe
Size 60KB
SHA256 61c3b35f21eace758bf013edb48a7346252faa91bfe2813296f9e24d259d0eea
MD5 b6a0dc6ab14fb508a85b16c881ddc52a
SHA1 676c82b410fa2a1ee0ed2df12f926b8ca62240e1
SHA512 207e778603791e45d61c97cff0aacc7c4fa7d5ad9dc6adbab98694a5f8f3f1eb4cd2badd0d12b4e593f4231d73db50c670b755226b099865751896734b913969
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwXY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrop4/CFsrd
TLSH
T17A5308834BDE9CF2F791113108798AB9927B99D4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F473C158-8A80-4b49-A807-572C597C80FA}.exe

Path C:\Windows\{F473C158-8A80-4b49-A807-572C597C80FA}.exe
Size 60KB
SHA256 412e56a8018be614f232ebe0900a59d41bf4752118f15d69b7614b963339ff4d
MD5 b8d36b1cb4ef7887a5301f2ab422d816
SHA1 9bbcc57789e53cb75abd255e2112ac29914e2c7e
SHA512 b3b78aa634ea5bc774d77aa6372aa0556e637bb9f399d7d44cbaaede4e428243b99f60d7a13fd1cef6512c5dfde87d6968af1f83331a37b9b178fa7222dc7f1b
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwBY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroz4/CFsrd
TLSH
T1B453F8834BDE9CF2F791117108794AB9927B9AC4950EBEDFBB90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads