stormser | 8a2d353c1a3e2dd6d65f2470d139937ad0c8e0726e33c000f190696117693cde

General

Target
2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe
Size 79KB
Sample261027-srlnrad12v
SHA256 8a2d353c1a3e2dd6d65f2470d139937ad0c8e0726e33c000f190696117693cde
MD5 69b0be2ae70f4c33762aaeec1160ad1a
SHA1 2d6c78330f595c47b196d97c1180d636e110084d
SHA512 cb429ea90a9b91b2481c7eb11310fc72c8e3b0e6865cc737272533d93c0b67f4deb12e60028088994e5e000442280fb765108190b92c04444a2415d55cf4bff2
SSDEEP 768:4vw9816vhKQLro84/wQzXOQ69zbjlAAX5e9zz:wEGh0o8lGizbR9Xwzz
TLSH
T14D835CD38EAC4483FDE6697012B8DAA77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024469-2.dat	family_stormser
behavioral1/files/0x000a000000024455-7.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEA0099D-AD27-466d-9B59-F8AFB8C04767}\stubpath = "C:\\Windows\\{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe"	2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}\stubpath = "C:\\Windows\\{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe"	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AEA0099D-AD27-466d-9B59-F8AFB8C04767}	2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe

Executes dropped EXE 2 IoCs

pid	Process
2096	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe
2576	{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe	2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe
File created	C:\Windows\{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
804	cmd.exe
1420	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5012	2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2096	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2096	5012	2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe	91
PID 5012 wrote to memory of 804	5012	2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe	92
PID 2096 wrote to memory of 2576	2096	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe	93
PID 2096 wrote to memory of 1420	2096	{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_69b0be2ae70f4c33762aaeec1160ad1a_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe
  C:\Windows\{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe
    C:\Windows\{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{AEA00~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1420
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe

Path C:\Windows\{AEA0099D-AD27-466d-9B59-F8AFB8C04767}.exe
Size 79KB
SHA256 7c250f6060faffb706cc5502dc9e30e0ce848ce334602b5fa9d08b0d69a49f0c
MD5 d71bbcd460abaad09f28f7ab75b3dfa2
SHA1 3f29ed763c0607ecffd2bb19437df96705154a02
SHA512 864f9ee976e98c1652f7516089ad2da5bffb916a9792247c0ec0b688f55bfb1ed0e55dcd5eb33f6207b7c23388aa215dc65df82d0197dcb9f9924a3fa7f2b4c8
SSDEEP 768:4vw9816vhKQLro84/wQzXOQ69zbjlAAX5e9zz:wEGh0o8lGizbR9Xwzz
TLSH
T171835CC38EAC4483FDE6697012B8D9A77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe

Path C:\Windows\{B1AC9EB5-FFC5-4bfb-8E59-78FA8C91C3B3}.exe
Size 79KB
SHA256 03b33afcbe3996993e39ed037fd3d6364c6679cf62040c71cd68d23e84dadb46
MD5 e98e4c008109150dd108ed357bcdc450
SHA1 808c55124a432a9a8f2f485c9645168d29370117
SHA512 f0ddb139607a7313f19746132cfb711d365a75088040599d24e75e3f4e93b574e1cf06c2334aaf2e62bd60a65cb2eeb69b05c843d7064cd4ea5eabf3dc39071c
SSDEEP 768:4vw9816vhKQLroOw4/wQzXOQ69zbjlAAX5e9zz:wEGh0oblGizbR9Xwzz
TLSH
T107835CC38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads