stormser | 6badc644390b01dbb4391e1405817025f2ddb72840c1cf5703c0998eaa68e319

General

Target
2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe
Size 60KB
Sample261027-bpec8ahx4v
SHA256 6badc644390b01dbb4391e1405817025f2ddb72840c1cf5703c0998eaa68e319
MD5 fb67d121b86dbd06ec4a916541690c7c
SHA1 4406485c4a5df724b5db886dc3df4a6714cffe0f
SHA512 782f3e4435c2e7d544377f9813421cbe5a29ecf4c5cde3ae16bf382e39e6d44a4155c63059a8609dd97e161ea5cf8192797798de18d5c36b0d61f2a29f1aa5b6
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroKx4/CFsrYAutg/CNl2e4WMZAj:vvw9816vhKQLro44/wQLfwl27WMZs
TLSH
T13C538D831F9A7CF2F3861071096E97BA926B49C4D25EBE9B7F50CC0D5062641E83D609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-2.dat	family_stormser
behavioral1/files/0x000400000002325d-6.dat	family_stormser
behavioral1/files/0x0008000000024461-10.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024459-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000400000002325d-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024461-10.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}	2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}\stubpath = "C:\\Windows\\{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe"	2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D87197EF-6260-4e4a-BCA3-3473F4F5866B}	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D87197EF-6260-4e4a-BCA3-3473F4F5866B}\stubpath = "C:\\Windows\\{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe"	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C99D0696-04E5-456e-B88C-13E092D8EDF2}	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C99D0696-04E5-456e-B88C-13E092D8EDF2}\stubpath = "C:\\Windows\\{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe"	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe

Executes dropped EXE 3 IoCs

pid	Process
4656	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
3912	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe
4604	{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe	2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe
File created	C:\Windows\{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
File created	C:\Windows\{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
620	cmd.exe
1904	cmd.exe
3196	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4748	2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe
Token: SeIncBasePriorityPrivilege	4656	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
Token: SeIncBasePriorityPrivilege	3912	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4656	4748	2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe	91
PID 4748 wrote to memory of 620	4748	2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe	92
PID 4656 wrote to memory of 3912	4656	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe	93
PID 4656 wrote to memory of 1904	4656	{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe	94
PID 3912 wrote to memory of 4604	3912	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe	97
PID 3912 wrote to memory of 3196	3912	{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_fb67d121b86dbd06ec4a916541690c7c_elex_remcos_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
  C:\Windows\{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe
    C:\Windows\{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe
      C:\Windows\{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4604
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D8719~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C95BD~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe

Path C:\Windows\{C95BD832-F34E-44c9-84BC-F3BFF3ACA848}.exe
Size 60KB
SHA256 460d66aac6871c898b3855fe67d0595e69e4c21769bd4bee88c95c5da6add6ab
MD5 476ec196f162a214fbaffdca7caca986
SHA1 ac9215bf9a2b9696212fc2dfe876ebd7a269fa1a
SHA512 debcaee34f486bfe8c6e775a884a9caddda8587ec94e7d973f40e4cf6efcab969d97f157aa02e5162677e82be207b0fe903f4350b27de8f8ac6a1c403f16a92e
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroKwA4/CFsrYAutg/CNl2e4WMZAj:vvw9816vhKQLro7A4/wQLfwl27WMZs
TLSH
T12E539D831F9A7CF2F3861071097E97BA926B49C4D25EBF9B7F50CC0D5062641E83D609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe

Path C:\Windows\{C99D0696-04E5-456e-B88C-13E092D8EDF2}.exe
Size 60KB
SHA256 d037fc4bb87a349e990612110547c9f698eaa85ef3fc183e1123478cba7d5110
MD5 f3b0488041ecd9f08b74fe0cdb463f5c
SHA1 bc74a8594274929ec26493e85870e53c92830395
SHA512 fb34493b1aa8a9b643f3791812a59cbcc40332a34a7ac6f4c74029c22913438be7c0dc803ad101e424c81e17ca0a5c50a8866ab485ff1276bbaab609a10dee87
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroKF4/CFsrYAutg/CNl2e4WMZAj:vvw9816vhKQLroc4/wQLfwl27WMZs
TLSH
T148539D831F9A7CF2F3861071096E97BA936B59C4D25EBF9B7F60CC0D5062641E83D609
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe

Path C:\Windows\{D87197EF-6260-4e4a-BCA3-3473F4F5866B}.exe
Size 60KB
SHA256 ac573702c9b701f7aecdc29d1cfdd135e75a94bd67ab47869ed64fa2d53f5d72
MD5 e367a34b8555d99e68275d2052993391
SHA1 9b1be09bc230adc3b7e6dd3e5372d444ca56bba8
SHA512 6eb0edc165397554686bd79985c703fdab1c2882b02e6f6460f9eb7e5156c2b770bedc701d3ce68508662819e6e3a73eb333242d6eabd57bc48ba6c5413c1621
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroK74/CFsrYAutg/CNl2e4WMZAj:vvw9816vhKQLroO4/wQLfwl27WMZs
TLSH
T1C2539D831F9A7CF2F3861071096E97BA926B49D4D29EBF9B7F50CC0D5062641E83D60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads