Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 04:12
General
- Target 2026-04-21_945949a124a38ca222ba46187002e43f_elex_goldeneye_wannacry.exe
- Size 180KB
- Sample260421-esnylsbv4z
- SHA256 4f27eaa4d67e0dfe8160651a92eb737f783f3c01a4edc937403b0ccad2174bf4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_945949a124a38ca222ba46187002e43f_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_945949a124a38ca222ba46187002e43f_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D30BF2B0-7977-4167-A3CB-E3D391490D52}.exeC:\Windows\{D30BF2B0-7977-4167-A3CB-E3D391490D52}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{203B5B13-3860-455d-BAC2-CACB12DC0417}.exeC:\Windows\{203B5B13-3860-455d-BAC2-CACB12DC0417}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE780BCA-93B2-4937-B9E4-9DB7957D7C32}.exeC:\Windows\{BE780BCA-93B2-4937-B9E4-9DB7957D7C32}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8A8F40C-15B0-485a-8AE0-A66C6D2D35E2}.exeC:\Windows\{B8A8F40C-15B0-485a-8AE0-A66C6D2D35E2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FEE6A25-201B-4874-8984-6C08C9582316}.exeC:\Windows\{5FEE6A25-201B-4874-8984-6C08C9582316}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1EB6B67C-8B65-4ab5-AC96-397E7F77A4DA}.exeC:\Windows\{1EB6B67C-8B65-4ab5-AC96-397E7F77A4DA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98597BFE-906A-4a02-A879-6D6D599AC41F}.exeC:\Windows\{98597BFE-906A-4a02-A879-6D6D599AC41F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B914F3E4-DF84-4795-B411-07F9C8764BAB}.exeC:\Windows\{B914F3E4-DF84-4795-B411-07F9C8764BAB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA568978-8D95-4e03-861A-EE61E350DEB8}.exeC:\Windows\{BA568978-8D95-4e03-861A-EE61E350DEB8}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E687BAC2-2AE4-4ca7-A403-2B292F7D17F4}.exeC:\Windows\{E687BAC2-2AE4-4ca7-A403-2B292F7D17F4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDA0B944-15B7-49c0-9426-7E8814B3DBE2}.exeC:\Windows\{CDA0B944-15B7-49c0-9426-7E8814B3DBE2}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E687B~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA568~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B914F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98597~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EB6B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FEE6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8A8F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE780~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{203B5~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D30BF~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1EB6B67C-8B65-4ab5-AC96-397E7F77A4DA}.exe
{203B5B13-3860-455d-BAC2-CACB12DC0417}.exe
{5FEE6A25-201B-4874-8984-6C08C9582316}.exe
{98597BFE-906A-4a02-A879-6D6D599AC41F}.exe
{B8A8F40C-15B0-485a-8AE0-A66C6D2D35E2}.exe
{B914F3E4-DF84-4795-B411-07F9C8764BAB}.exe
{BA568978-8D95-4e03-861A-EE61E350DEB8}.exe
{BE780BCA-93B2-4937-B9E4-9DB7957D7C32}.exe
{CDA0B944-15B7-49c0-9426-7E8814B3DBE2}.exe
{D30BF2B0-7977-4167-A3CB-E3D391490D52}.exe
{E687BAC2-2AE4-4ca7-A403-2B292F7D17F4}.exe
memory/712-23-0x0000000002220000-0x0000000002283000-memory.dmp
memory/712-18-0x0000000002220000-0x0000000002283000-memory.dmp
memory/2200-48-0x0000000003CF0000-0x0000000003D53000-memory.dmp
memory/2200-52-0x0000000003CF0000-0x0000000003D53000-memory.dmp
memory/2492-58-0x0000000003CD0000-0x0000000003D33000-memory.dmp
memory/2492-54-0x0000000003CD0000-0x0000000003D33000-memory.dmp
memory/2760-0-0x0000000003E10000-0x0000000003E73000-memory.dmp
memory/2760-5-0x0000000003E10000-0x0000000003E73000-memory.dmp
memory/2896-36-0x0000000002020000-0x0000000002083000-memory.dmp
memory/2896-39-0x0000000002020000-0x0000000002083000-memory.dmp
memory/3176-10-0x0000000003C80000-0x0000000003CE3000-memory.dmp
memory/3176-6-0x0000000003C80000-0x0000000003CE3000-memory.dmp
memory/4324-30-0x0000000003DD0000-0x0000000003E33000-memory.dmp
memory/4324-35-0x0000000003DD0000-0x0000000003E33000-memory.dmp
memory/4716-64-0x0000000002160000-0x00000000021C3000-memory.dmp
memory/4716-60-0x0000000002160000-0x00000000021C3000-memory.dmp
memory/4972-42-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/4972-46-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/5044-12-0x0000000002010000-0x0000000002073000-memory.dmp
memory/5044-17-0x0000000002010000-0x0000000002073000-memory.dmp
memory/5088-27-0x0000000002150000-0x00000000021B3000-memory.dmp
memory/5088-24-0x0000000002150000-0x00000000021B3000-memory.dmp