Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
15/04/2026, 03:45
General
- Target 2026-04-15_8d4902f7078997a6b5e106d0c61077f7_elex_goldeneye_wannacry.exe
- Size 408KB
- Sample260415-ea2rraes3p
- SHA256 387d4d1197a9cf6ed78bcca1410500ad735cba7ac27ce8aa4b763bb6d01c4d0e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_8d4902f7078997a6b5e106d0c61077f7_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_8d4902f7078997a6b5e106d0c61077f7_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3240B640-A97F-4741-ABEE-21084D5BFC30}.exeC:\Windows\{3240B640-A97F-4741-ABEE-21084D5BFC30}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D761699A-33D9-47f5-80B2-A91982C2B77E}.exeC:\Windows\{D761699A-33D9-47f5-80B2-A91982C2B77E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{749A4DCC-7E5F-487a-95DE-6E7B668810C7}.exeC:\Windows\{749A4DCC-7E5F-487a-95DE-6E7B668810C7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92DC342D-54F0-4b31-866B-DF293AB383C2}.exeC:\Windows\{92DC342D-54F0-4b31-866B-DF293AB383C2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83B196DA-F132-4e46-A515-C903FAE78B91}.exeC:\Windows\{83B196DA-F132-4e46-A515-C903FAE78B91}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{002F285E-3672-413e-8BC2-96EDA1849033}.exeC:\Windows\{002F285E-3672-413e-8BC2-96EDA1849033}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1894903-D5D1-402a-BB27-CD8A2EF60A7C}.exeC:\Windows\{F1894903-D5D1-402a-BB27-CD8A2EF60A7C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B353F016-B052-414a-95F3-28DA6CE8A674}.exeC:\Windows\{B353F016-B052-414a-95F3-28DA6CE8A674}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A069C02-3D77-4216-91FC-ACEF5D37AC50}.exeC:\Windows\{5A069C02-3D77-4216-91FC-ACEF5D37AC50}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C7BB6C5-26A7-4bfe-BCD7-71001EB7DB1E}.exeC:\Windows\{0C7BB6C5-26A7-4bfe-BCD7-71001EB7DB1E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A6F57CA-E93A-4f69-A33B-8550AD354C65}.exeC:\Windows\{9A6F57CA-E93A-4f69-A33B-8550AD354C65}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C7BB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A069~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B353F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1894~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{002F2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83B19~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92DC3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{749A4~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D7616~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3240B~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{002F285E-3672-413e-8BC2-96EDA1849033}.exe
{0C7BB6C5-26A7-4bfe-BCD7-71001EB7DB1E}.exe
{3240B640-A97F-4741-ABEE-21084D5BFC30}.exe
{5A069C02-3D77-4216-91FC-ACEF5D37AC50}.exe
{749A4DCC-7E5F-487a-95DE-6E7B668810C7}.exe
{83B196DA-F132-4e46-A515-C903FAE78B91}.exe
{92DC342D-54F0-4b31-866B-DF293AB383C2}.exe
{9A6F57CA-E93A-4f69-A33B-8550AD354C65}.exe
{B353F016-B052-414a-95F3-28DA6CE8A674}.exe
{D761699A-33D9-47f5-80B2-A91982C2B77E}.exe
{F1894903-D5D1-402a-BB27-CD8A2EF60A7C}.exe
memory/536-58-0x00000000007B0000-0x0000000000A31000-memory.dmp
memory/536-54-0x00000000007B0000-0x0000000000A31000-memory.dmp
memory/908-24-0x00000000007A0000-0x0000000000A21000-memory.dmp
memory/908-29-0x00000000007A0000-0x0000000000A21000-memory.dmp
memory/1228-46-0x00000000007A0000-0x0000000000A21000-memory.dmp
memory/1228-42-0x00000000007A0000-0x0000000000A21000-memory.dmp
memory/1656-18-0x0000000000820000-0x0000000000AA1000-memory.dmp
memory/1656-22-0x0000000000820000-0x0000000000AA1000-memory.dmp
memory/2964-36-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/2964-40-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/4436-9-0x0000000000870000-0x0000000000AF1000-memory.dmp
memory/4436-6-0x0000000000870000-0x0000000000AF1000-memory.dmp
memory/4744-0-0x0000000000950000-0x0000000000BD1000-memory.dmp
memory/4744-5-0x0000000000950000-0x0000000000BD1000-memory.dmp
memory/5032-63-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/5032-60-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/5144-48-0x00000000008A0000-0x0000000000B21000-memory.dmp
memory/5144-51-0x00000000008A0000-0x0000000000B21000-memory.dmp
memory/5620-15-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/5620-12-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/5940-34-0x0000000000810000-0x0000000000A91000-memory.dmp
memory/5940-30-0x0000000000810000-0x0000000000A91000-memory.dmp