Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 15:36
General
- Target 2026-04-20_cfc3c961705aae0522925a9b8894e98b_elex_goldeneye_wannacry.exe
- Size 372KB
- Sample260420-s2an8set7l
- SHA256 ae7c78eca2f9be40cace7bfad3c68decc283ffd3a365dac97e46153098760222
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_cfc3c961705aae0522925a9b8894e98b_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_cfc3c961705aae0522925a9b8894e98b_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03F23A14-B997-455b-BF24-4DCF5653C384}.exeC:\Windows\{03F23A14-B997-455b-BF24-4DCF5653C384}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{237EEA99-489A-48fb-91C7-FD515CA5AB6E}.exeC:\Windows\{237EEA99-489A-48fb-91C7-FD515CA5AB6E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EED3FBD-7288-4462-8C95-2CA7C5EE8298}.exeC:\Windows\{2EED3FBD-7288-4462-8C95-2CA7C5EE8298}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18255C69-341B-4ecf-A766-E4055465E373}.exeC:\Windows\{18255C69-341B-4ecf-A766-E4055465E373}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F05FA831-14D5-4be3-BF48-B4B9233505AC}.exeC:\Windows\{F05FA831-14D5-4be3-BF48-B4B9233505AC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C052BFC-31DE-4b9d-8616-6716D72E5624}.exeC:\Windows\{5C052BFC-31DE-4b9d-8616-6716D72E5624}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D8783C6-7F2B-4a81-8689-52C62D69A981}.exeC:\Windows\{4D8783C6-7F2B-4a81-8689-52C62D69A981}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E98AE50-AEE7-4fd9-AD70-C56167201415}.exeC:\Windows\{4E98AE50-AEE7-4fd9-AD70-C56167201415}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17F328F9-8CA0-45aa-9CE8-6E01F11D3C38}.exeC:\Windows\{17F328F9-8CA0-45aa-9CE8-6E01F11D3C38}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50EEE92D-99D8-414f-BBFC-52CFFB22D95D}.exeC:\Windows\{50EEE92D-99D8-414f-BBFC-52CFFB22D95D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65209A7C-1CE9-40a1-9EFD-1732E28F0238}.exeC:\Windows\{65209A7C-1CE9-40a1-9EFD-1732E28F0238}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50EEE~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17F32~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E98A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D878~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C052~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F05FA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18255~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EED3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{237EE~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03F23~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03F23A14-B997-455b-BF24-4DCF5653C384}.exe
{17F328F9-8CA0-45aa-9CE8-6E01F11D3C38}.exe
{18255C69-341B-4ecf-A766-E4055465E373}.exe
{237EEA99-489A-48fb-91C7-FD515CA5AB6E}.exe
{2EED3FBD-7288-4462-8C95-2CA7C5EE8298}.exe
{4D8783C6-7F2B-4a81-8689-52C62D69A981}.exe
{4E98AE50-AEE7-4fd9-AD70-C56167201415}.exe
{50EEE92D-99D8-414f-BBFC-52CFFB22D95D}.exe
{5C052BFC-31DE-4b9d-8616-6716D72E5624}.exe
{65209A7C-1CE9-40a1-9EFD-1732E28F0238}.exe
{F05FA831-14D5-4be3-BF48-B4B9233505AC}.exe
memory/440-54-0x0000000000570000-0x00000000005EA000-memory.dmp
memory/940-30-0x00000000007A0000-0x000000000081A000-memory.dmp
memory/1424-60-0x0000000000550000-0x00000000005CA000-memory.dmp
memory/1816-24-0x00000000006C0000-0x000000000073A000-memory.dmp
memory/2240-42-0x00000000007E0000-0x000000000085A000-memory.dmp
memory/2856-48-0x00000000008E0000-0x000000000095A000-memory.dmp
memory/3916-36-0x00000000008D0000-0x000000000094A000-memory.dmp
memory/4032-0-0x0000000000A10000-0x0000000000A8A000-memory.dmp
memory/4376-6-0x0000000000570000-0x00000000005EA000-memory.dmp
memory/4532-18-0x0000000000A20000-0x0000000000A9A000-memory.dmp
memory/4636-12-0x00000000006B0000-0x000000000072A000-memory.dmp