stormser | 68373b79a981190cf6ff32e0484f6b9e4573fda860f47710892367ffe00a8cdd

General

Target
2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe
Size 79KB
Sample261024-tk2xtscw5j
SHA256 68373b79a981190cf6ff32e0484f6b9e4573fda860f47710892367ffe00a8cdd
MD5 3ba29e62a5626b7f6804700668d8e00e
SHA1 4596cb1898f22150f0ce257645e9f2245020f072
SHA512 1fe39cdb81ff16bb55642fe761f3ad0d4440378bdd4e7893fb0366ca027783bffc450008a73b5dbbddf5aa1b083daedd689edc7e72d24ea06c1da2d1318061af
SSDEEP 768:4vw9816vhKQLroB4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oBloWMZ3izbR9Xwzz
TLSH
T1A1834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000f000000024632-3.dat	family_stormser
behavioral1/files/0x0008000000024623-5.dat	family_stormser
behavioral1/files/0x000800000002463a-10.dat	family_stormser
behavioral1/files/0x0009000000024623-14.dat	family_stormser
behavioral1/files/0x00050000000006d9-18.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral1/files/0x000f000000024632-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024623-5.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000800000002463a-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0009000000024623-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x00050000000006d9-18.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EB671DE-87BD-480c-951A-BE3982A91DD9}	2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EB671DE-87BD-480c-951A-BE3982A91DD9}\stubpath = "C:\\Windows\\{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe"	2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}\stubpath = "C:\\Windows\\{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe"	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}\stubpath = "C:\\Windows\\{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe"	{F5A63122-EB91-4571-B07E-623633A90B23}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F130B8D3-143D-41c6-AE47-8411A42A331F}	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F130B8D3-143D-41c6-AE47-8411A42A331F}\stubpath = "C:\\Windows\\{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe"	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5A63122-EB91-4571-B07E-623633A90B23}	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F5A63122-EB91-4571-B07E-623633A90B23}\stubpath = "C:\\Windows\\{F5A63122-EB91-4571-B07E-623633A90B23}.exe"	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}	{F5A63122-EB91-4571-B07E-623633A90B23}.exe

Executes dropped EXE 5 IoCs

pid	Process
5512	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
5376	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
1720	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
4780	{F5A63122-EB91-4571-B07E-623633A90B23}.exe
364	{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
File created	C:\Windows\{F5A63122-EB91-4571-B07E-623633A90B23}.exe	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
File created	C:\Windows\{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe	{F5A63122-EB91-4571-B07E-623633A90B23}.exe
File created	C:\Windows\{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe	2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe
File created	C:\Windows\{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2544	cmd.exe
5736	cmd.exe
3876	cmd.exe
5588	cmd.exe
1272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F5A63122-EB91-4571-B07E-623633A90B23}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	6072	2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	5512	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
Token: SeIncBasePriorityPrivilege	5376	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
Token: SeIncBasePriorityPrivilege	1720	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
Token: SeIncBasePriorityPrivilege	4780	{F5A63122-EB91-4571-B07E-623633A90B23}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6072 wrote to memory of 5512	6072	2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe	92
PID 6072 wrote to memory of 2544	6072	2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe	93
PID 5512 wrote to memory of 5376	5512	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe	94
PID 5512 wrote to memory of 5736	5512	{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe	95
PID 5376 wrote to memory of 1720	5376	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe	99
PID 5376 wrote to memory of 3876	5376	{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe	100
PID 1720 wrote to memory of 4780	1720	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe	101
PID 1720 wrote to memory of 5588	1720	{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe	102
PID 4780 wrote to memory of 364	4780	{F5A63122-EB91-4571-B07E-623633A90B23}.exe	103
PID 4780 wrote to memory of 1272	4780	{F5A63122-EB91-4571-B07E-623633A90B23}.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3ba29e62a5626b7f6804700668d8e00e_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6072
- C:\Windows\{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
  C:\Windows\{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5512
- - C:\Windows\{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
    C:\Windows\{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\Windows\{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
      C:\Windows\{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Windows\{F5A63122-EB91-4571-B07E-623633A90B23}.exe
        
        C:\Windows\{F5A63122-EB91-4571-B07E-623633A90B23}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4780
      - C:\Windows\{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe
        
        C:\Windows\{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F5A63~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1272
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2FF6B~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5588
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F130B~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1EB67~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe

Path C:\Windows\{1EB671DE-87BD-480c-951A-BE3982A91DD9}.exe
Size 79KB
SHA256 33fd0a9be96b6def174a0ca75572650092c31fc431a32d91d8f91ca62bb8d3e4
MD5 02ff6ea9ae77665e224f9be7199703ff
SHA1 a724aa1d1898c9bcf5fe7818439f65a6e59084ed
SHA512 1e440baf99ecb04730477b2d5ea85c6ae1daeff1bc8c5c02129292298ab596cf77c2b6e06df989f23bebc7a26d67d00b8b172d2a4ee8ab731b85afcd1d09fe2d
SSDEEP 768:4vw9816vhKQLrod4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0odloWMZ3izbR9Xwzz
TLSH
T118834BC38E6C6483FE96297012A8DABB7D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe

Path C:\Windows\{2FF6B17F-0184-42ec-A9CB-A113824AB2CF}.exe
Size 79KB
SHA256 fdae85fec5f5263d0462311bda3223336ea99280916a46c34c4135a3327ff97a
MD5 5ba04d522624934f18b6e427b5394e9b
SHA1 d44b7dc80afbb2c89905b7ae00ac29a1008d871d
SHA512 0047012cb9d084957eca580a253d0cd16fd20d93f263b4f5899f4ae79030300429eb211cf4e2f04020e3fe7ab8578f96f021e4dcc466febe97e66fa8c7ba8b21
SSDEEP 768:4vw9816vhKQLroT4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oTloWMZ3izbR9Xwzz
TLSH
T1A8834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe

Path C:\Windows\{EFF7BB79-61A2-4fc5-A348-C0F060A01E07}.exe
Size 79KB
SHA256 43453f1e0694f3059490e3983810901d7dc5c83179c2424956af45e11cf7c3de
MD5 84a460c84b4e2316fb60ea0091d0b9d0
SHA1 d4bbc10268555f8e6489551f8abcf4165c8e662f
SHA512 e3b97dfe998460f0aaabd648b458ef0bbab9d981b1eaaa18fc1b63eb149862ef8eb28afce4c956004936aad8f8604911059a7b9f34dc98637f8a343328c1c014
SSDEEP 768:4vw9816vhKQLrog4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0ogloWMZ3izbR9Xwzz
TLSH
T158834BC38E6C6483FE96297012A8DABB7D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe

Path C:\Windows\{F130B8D3-143D-41c6-AE47-8411A42A331F}.exe
Size 79KB
SHA256 80f99d09cb3ecde351f1237cd926bbe03c40d2cfdbcf56e6f1c22fa44fd6dfaf
MD5 834995f798416e32fdeacb75317da3c3
SHA1 09703310cab6eb8a0f3709aed3243932b92a3015
SHA512 1462580e411af5af7d0626b3272e1969a6b2dab55a7383e229662568ee6cb847650b045d4a950105cadbe093eb16b98075bea62ca126c5d44007ed45462244e7
SSDEEP 768:4vw9816vhKQLroy4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0oyloWMZ3izbR9Xwzz
TLSH
T1FE834CC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F5A63122-EB91-4571-B07E-623633A90B23}.exe

Path C:\Windows\{F5A63122-EB91-4571-B07E-623633A90B23}.exe
Size 79KB
SHA256 bf5a7553cc4bcbc5ef5a3f0e3446c94c10cd541cacb46b70c2d9f6bb4c8e6f73
MD5 1155fc429845e046c31cafdcb77d08ed
SHA1 b2e20290920e5cdf70b1eab5d4246016acafde1b
SHA512 441fee719c96c3f691027f137e2e744974e68147f0e0d36477cce2ed5f055db8454306b737a2b62b7ea0baf6d7c2afa785dc08a413d3fbc09ad7c28acab26eb1
SSDEEP 768:4vw9816vhKQLro34/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0o3loWMZ3izbR9Xwzz
TLSH
T128834BC38E6C6483FE96297012A8DABB7D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads