Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 17:07
General
- Target 2026-04-17_840918185a41da277a4952a82f8f5a84_elex_goldeneye_wannacry.exe
- Size 380KB
- Sample260417-vm1yzsgz4t
- SHA256 f7684dd9e342b63322716405fe25d53bbba550735a11d5897618d585a037c872
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureAuto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_840918185a41da277a4952a82f8f5a84_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_840918185a41da277a4952a82f8f5a84_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A584B082-0E7C-4e8a-9C9D-6AA8AFE9BA6B}.exeC:\Windows\{A584B082-0E7C-4e8a-9C9D-6AA8AFE9BA6B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1763CDC-8B12-4f58-9F4D-01AF3074814B}.exeC:\Windows\{D1763CDC-8B12-4f58-9F4D-01AF3074814B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAD6CA6B-1B97-4adc-94B2-E0B1EE679133}.exeC:\Windows\{BAD6CA6B-1B97-4adc-94B2-E0B1EE679133}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57ED561D-B0EE-4330-8C1E-73FB900FDAC6}.exeC:\Windows\{57ED561D-B0EE-4330-8C1E-73FB900FDAC6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBBD025E-E85F-4fc4-8D0C-0256F2C88986}.exeC:\Windows\{DBBD025E-E85F-4fc4-8D0C-0256F2C88986}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{657E24BD-7C3F-4f71-B106-A639C25F5046}.exeC:\Windows\{657E24BD-7C3F-4f71-B106-A639C25F5046}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48F25799-5C99-4542-B0B0-1CE78E1261DA}.exeC:\Windows\{48F25799-5C99-4542-B0B0-1CE78E1261DA}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A4A3C19-A7D8-4989-81DF-D70A9094B4F7}.exeC:\Windows\{8A4A3C19-A7D8-4989-81DF-D70A9094B4F7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1F65C33-3D06-4951-B225-C8C26D684AC0}.exeC:\Windows\{A1F65C33-3D06-4951-B225-C8C26D684AC0}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83086329-9604-4f1d-966F-1CB68207B71B}.exeC:\Windows\{83086329-9604-4f1d-966F-1CB68207B71B}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF1E68D8-FE2C-414c-8077-07BDB8EB865F}.exeC:\Windows\{EF1E68D8-FE2C-414c-8077-07BDB8EB865F}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83086~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1F65~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A4A3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48F25~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{657E2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBBD0~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57ED5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAD6C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1763~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A584B~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{48F25799-5C99-4542-B0B0-1CE78E1261DA}.exe
{57ED561D-B0EE-4330-8C1E-73FB900FDAC6}.exe
{657E24BD-7C3F-4f71-B106-A639C25F5046}.exe
{83086329-9604-4f1d-966F-1CB68207B71B}.exe
{8A4A3C19-A7D8-4989-81DF-D70A9094B4F7}.exe
{A1F65C33-3D06-4951-B225-C8C26D684AC0}.exe
{A584B082-0E7C-4e8a-9C9D-6AA8AFE9BA6B}.exe
{BAD6CA6B-1B97-4adc-94B2-E0B1EE679133}.exe
{D1763CDC-8B12-4f58-9F4D-01AF3074814B}.exe
{DBBD025E-E85F-4fc4-8D0C-0256F2C88986}.exe
{EF1E68D8-FE2C-414c-8077-07BDB8EB865F}.exe
memory/1376-47-0x0000000000890000-0x0000000000B11000-memory.dmp
memory/1376-42-0x0000000000890000-0x0000000000B11000-memory.dmp
memory/1472-30-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/1472-33-0x00000000007D0000-0x0000000000A51000-memory.dmp
memory/2740-22-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/2740-18-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/2760-27-0x0000000000870000-0x0000000000AF1000-memory.dmp
memory/2760-24-0x0000000000870000-0x0000000000AF1000-memory.dmp
memory/2968-10-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/2968-6-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/3056-48-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/3056-51-0x00000000007E0000-0x0000000000A61000-memory.dmp
memory/3480-41-0x0000000000800000-0x0000000000A81000-memory.dmp
memory/3480-36-0x0000000000800000-0x0000000000A81000-memory.dmp
memory/3976-60-0x0000000000840000-0x0000000000AC1000-memory.dmp
memory/3976-65-0x0000000000840000-0x0000000000AC1000-memory.dmp
memory/4408-15-0x00000000007B0000-0x0000000000A31000-memory.dmp
memory/4408-12-0x00000000007B0000-0x0000000000A31000-memory.dmp
memory/4496-0-0x0000000000A50000-0x0000000000CD1000-memory.dmp
memory/4496-5-0x0000000000A50000-0x0000000000CD1000-memory.dmp
memory/6072-54-0x00000000007F0000-0x0000000000A71000-memory.dmp
memory/6072-57-0x00000000007F0000-0x0000000000A71000-memory.dmp