Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 03:46
General
- Target 2026-04-17_889805f3ec875a88f787765b3a302ed8_elex_goldeneye_wannacry.exe
- Size 216KB
- Sample260417-eb1wvaew2p
- SHA256 22086149274cad79b9e84621ec7693c65467d649e6a57a00826148158facf738
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_889805f3ec875a88f787765b3a302ed8_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_889805f3ec875a88f787765b3a302ed8_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{709BA531-C0B8-415c-97AC-DB706004149B}.exeC:\Windows\{709BA531-C0B8-415c-97AC-DB706004149B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0B709CE-F1CE-4b51-88D4-803EFB4AC839}.exeC:\Windows\{E0B709CE-F1CE-4b51-88D4-803EFB4AC839}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07ABE16E-39CE-499b-80BD-60F9AA4D3EE1}.exeC:\Windows\{07ABE16E-39CE-499b-80BD-60F9AA4D3EE1}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0297C3FC-2AF4-4acb-954F-9CAB31B560B1}.exeC:\Windows\{0297C3FC-2AF4-4acb-954F-9CAB31B560B1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B40B1DAC-C4EE-47b9-841D-228A3A81F91F}.exeC:\Windows\{B40B1DAC-C4EE-47b9-841D-228A3A81F91F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1333906-1DE7-46d2-9A41-F8A7C7D8BEFD}.exeC:\Windows\{E1333906-1DE7-46d2-9A41-F8A7C7D8BEFD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DCAA786E-A5A8-4b42-B9BB-B4AB634B4882}.exeC:\Windows\{DCAA786E-A5A8-4b42-B9BB-B4AB634B4882}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7527F44A-EA78-418e-AECD-A4E5B7005C90}.exeC:\Windows\{7527F44A-EA78-418e-AECD-A4E5B7005C90}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9DC1891D-DE9C-4787-BACB-CED83EBE94E5}.exeC:\Windows\{9DC1891D-DE9C-4787-BACB-CED83EBE94E5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC1D3352-8BA4-4580-8BEC-D83E96158F06}.exeC:\Windows\{AC1D3352-8BA4-4580-8BEC-D83E96158F06}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5995CB48-F439-4e61-8C4C-047EF9771C08}.exeC:\Windows\{5995CB48-F439-4e61-8C4C-047EF9771C08}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC1D3~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DC18~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7527F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DCAA7~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1333~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B40B1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0297C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07ABE~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0B70~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{709BA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0297C3FC-2AF4-4acb-954F-9CAB31B560B1}.exe
{07ABE16E-39CE-499b-80BD-60F9AA4D3EE1}.exe
{5995CB48-F439-4e61-8C4C-047EF9771C08}.exe
{709BA531-C0B8-415c-97AC-DB706004149B}.exe
{7527F44A-EA78-418e-AECD-A4E5B7005C90}.exe
{9DC1891D-DE9C-4787-BACB-CED83EBE94E5}.exe
{AC1D3352-8BA4-4580-8BEC-D83E96158F06}.exe
{B40B1DAC-C4EE-47b9-841D-228A3A81F91F}.exe
{DCAA786E-A5A8-4b42-B9BB-B4AB634B4882}.exe
{E0B709CE-F1CE-4b51-88D4-803EFB4AC839}.exe
{E1333906-1DE7-46d2-9A41-F8A7C7D8BEFD}.exe
memory/444-40-0x00000000006D0000-0x0000000000766000-memory.dmp
memory/444-36-0x00000000006D0000-0x0000000000766000-memory.dmp
memory/1732-24-0x00000000008F0000-0x0000000000986000-memory.dmp
memory/1732-28-0x00000000008F0000-0x0000000000986000-memory.dmp
memory/2212-10-0x00000000005C0000-0x0000000000656000-memory.dmp
memory/2212-6-0x00000000005C0000-0x0000000000656000-memory.dmp
memory/2420-54-0x0000000000530000-0x00000000005C6000-memory.dmp
memory/2420-58-0x0000000000530000-0x00000000005C6000-memory.dmp
memory/3092-48-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/3092-51-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/3220-46-0x00000000005C0000-0x0000000000656000-memory.dmp
memory/3220-42-0x00000000005C0000-0x0000000000656000-memory.dmp
memory/3820-22-0x0000000000640000-0x00000000006D6000-memory.dmp
memory/3820-18-0x0000000000640000-0x00000000006D6000-memory.dmp
memory/4024-60-0x0000000000740000-0x00000000007D6000-memory.dmp
memory/4024-63-0x0000000000740000-0x00000000007D6000-memory.dmp
memory/4532-16-0x00000000008C0000-0x0000000000956000-memory.dmp
memory/4532-12-0x00000000008C0000-0x0000000000956000-memory.dmp
memory/4836-0-0x0000000000680000-0x0000000000716000-memory.dmp
memory/4836-5-0x0000000000680000-0x0000000000716000-memory.dmp
memory/5060-30-0x00000000008E0000-0x0000000000976000-memory.dmp
memory/5060-34-0x00000000008E0000-0x0000000000976000-memory.dmp