Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 11:30
General
- Target 2026-11-11_5ee1436e90551c5a8480c4a7af03a18b_elex_wannacry.exe
- Size 72KB
- Sample261113-nmemesay2w
- SHA256 ea5ffda868431d87d964567507c3106350f5e60a2550b7e0957d8bb29e536298
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 45 IoCs
- Custom signatureUPX dump on OEP (original entry point) 45 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-11_5ee1436e90551c5a8480c4a7af03a18b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-11_5ee1436e90551c5a8480c4a7af03a18b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A8657D4-411B-4847-81B2-D927A68CA4FB}.exeC:\Windows\{8A8657D4-411B-4847-81B2-D927A68CA4FB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{920DFFAF-D162-44ff-B673-D128E9F1533A}.exeC:\Windows\{920DFFAF-D162-44ff-B673-D128E9F1533A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8730A2CC-CFF2-41ec-8C7D-46B96C55DCB2}.exeC:\Windows\{8730A2CC-CFF2-41ec-8C7D-46B96C55DCB2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EB7E780-11F0-4bda-82CB-7F70DB30E9C5}.exeC:\Windows\{0EB7E780-11F0-4bda-82CB-7F70DB30E9C5}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DC9AE71-587D-446c-930D-E5A3614AE85C}.exeC:\Windows\{0DC9AE71-587D-446c-930D-E5A3614AE85C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73E114E5-ED3B-4a4d-8C16-13F747B009D6}.exeC:\Windows\{73E114E5-ED3B-4a4d-8C16-13F747B009D6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0C3B1D7-12DC-4f65-AE4D-C5E0BC38D1E1}.exeC:\Windows\{A0C3B1D7-12DC-4f65-AE4D-C5E0BC38D1E1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{54017EC4-1FE4-4e9d-B571-9FAC9ABED3F3}.exeC:\Windows\{54017EC4-1FE4-4e9d-B571-9FAC9ABED3F3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67E3CB2B-9ACE-4e54-AE6C-A3E802F624AD}.exeC:\Windows\{67E3CB2B-9ACE-4e54-AE6C-A3E802F624AD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38C93CD0-98B9-415c-A67C-6700D4903112}.exeC:\Windows\{38C93CD0-98B9-415c-A67C-6700D4903112}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02EA78DE-320C-41cb-86C1-9E93CC49051E}.exeC:\Windows\{02EA78DE-320C-41cb-86C1-9E93CC49051E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38C93~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67E3C~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54017~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0C3B~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73E11~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0DC9A~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EB7E~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8730A~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{920DF~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A865~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{02EA78DE-320C-41cb-86C1-9E93CC49051E}.exe
{0DC9AE71-587D-446c-930D-E5A3614AE85C}.exe
{0EB7E780-11F0-4bda-82CB-7F70DB30E9C5}.exe
{38C93CD0-98B9-415c-A67C-6700D4903112}.exe
{54017EC4-1FE4-4e9d-B571-9FAC9ABED3F3}.exe
{67E3CB2B-9ACE-4e54-AE6C-A3E802F624AD}.exe
{73E114E5-ED3B-4a4d-8C16-13F747B009D6}.exe
{8730A2CC-CFF2-41ec-8C7D-46B96C55DCB2}.exe
{8A8657D4-411B-4847-81B2-D927A68CA4FB}.exe
{920DFFAF-D162-44ff-B673-D128E9F1533A}.exe
{A0C3B1D7-12DC-4f65-AE4D-C5E0BC38D1E1}.exe
memory/1172-53-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1172-49-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1172-47-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2436-57-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2436-55-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2436-63-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2580-39-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2580-46-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2580-41-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3000-65-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3000-69-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3000-62-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3068-79-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3068-85-0x0000000000400000-0x0000000000413000-memory.dmp
memory/3068-81-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4140-8-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4140-0-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4140-1-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4328-87-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4344-15-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4344-17-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4344-23-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4468-37-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4468-31-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4468-33-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4700-22-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4700-25-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4700-29-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4980-6-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4980-9-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4980-14-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5864-73-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5864-78-0x0000000000400000-0x0000000000413000-memory.dmp
memory/5864-71-0x0000000000400000-0x0000000000413000-memory.dmp