Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 12:45
General
- Target 2026-04-22_0d2e8d53e4873b85e6e7a345abf4207b_elex_goldeneye_wannacry.exe
- Size 216KB
- Sample260422-py5tesfv8k
- SHA256 408e082e35de76e116048600244d7194507c2865779a1d183fe64355761ed54c
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_0d2e8d53e4873b85e6e7a345abf4207b_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_0d2e8d53e4873b85e6e7a345abf4207b_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49E7E01E-2F63-41b0-8B6F-9C5B0F010C8B}.exeC:\Windows\{49E7E01E-2F63-41b0-8B6F-9C5B0F010C8B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D83B0929-D6DC-4eca-B886-78597ABB28E3}.exeC:\Windows\{D83B0929-D6DC-4eca-B886-78597ABB28E3}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B35645D7-132E-4a7f-B080-FFADEB7DB3AF}.exeC:\Windows\{B35645D7-132E-4a7f-B080-FFADEB7DB3AF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0AC9031-3A2C-4110-AC21-A2FE62755E47}.exeC:\Windows\{A0AC9031-3A2C-4110-AC21-A2FE62755E47}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04684DA9-4803-4077-A56A-3DC60397B3F7}.exeC:\Windows\{04684DA9-4803-4077-A56A-3DC60397B3F7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F510879B-5A7C-48b4-9B61-C76A99023011}.exeC:\Windows\{F510879B-5A7C-48b4-9B61-C76A99023011}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A4B7CAC-019A-46c6-BCA9-832CB235311B}.exeC:\Windows\{5A4B7CAC-019A-46c6-BCA9-832CB235311B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C51884C-23B1-4e2c-B8F9-0405AF4024E9}.exeC:\Windows\{9C51884C-23B1-4e2c-B8F9-0405AF4024E9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B060E79B-1E09-4603-BE14-302EC2CA0A33}.exeC:\Windows\{B060E79B-1E09-4603-BE14-302EC2CA0A33}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{645B1211-60FE-4eeb-9711-29D7DAA89395}.exeC:\Windows\{645B1211-60FE-4eeb-9711-29D7DAA89395}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE012275-96DC-46ed-BA4E-D136A486C431}.exeC:\Windows\{CE012275-96DC-46ed-BA4E-D136A486C431}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{645B1~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B060E~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C518~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A4B7~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5108~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04684~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0AC9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3564~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D83B0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49E7E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04684DA9-4803-4077-A56A-3DC60397B3F7}.exe
{49E7E01E-2F63-41b0-8B6F-9C5B0F010C8B}.exe
{5A4B7CAC-019A-46c6-BCA9-832CB235311B}.exe
{645B1211-60FE-4eeb-9711-29D7DAA89395}.exe
{9C51884C-23B1-4e2c-B8F9-0405AF4024E9}.exe
{A0AC9031-3A2C-4110-AC21-A2FE62755E47}.exe
{B060E79B-1E09-4603-BE14-302EC2CA0A33}.exe
{B35645D7-132E-4a7f-B080-FFADEB7DB3AF}.exe
{CE012275-96DC-46ed-BA4E-D136A486C431}.exe
{D83B0929-D6DC-4eca-B886-78597ABB28E3}.exe
{F510879B-5A7C-48b4-9B61-C76A99023011}.exe
memory/3284-48-0x00000000009B0000-0x0000000000A2A000-memory.dmp
memory/3284-52-0x00000000009B0000-0x0000000000A2A000-memory.dmp
memory/3464-33-0x0000000000670000-0x00000000006EA000-memory.dmp
memory/3464-30-0x0000000000670000-0x00000000006EA000-memory.dmp
memory/3708-18-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/3708-22-0x0000000000870000-0x00000000008EA000-memory.dmp
memory/4224-24-0x0000000000890000-0x000000000090A000-memory.dmp
memory/4224-28-0x0000000000890000-0x000000000090A000-memory.dmp
memory/4388-64-0x0000000000670000-0x00000000006EA000-memory.dmp
memory/4388-60-0x0000000000670000-0x00000000006EA000-memory.dmp
memory/4856-10-0x0000000000990000-0x0000000000A0A000-memory.dmp
memory/4856-6-0x0000000000990000-0x0000000000A0A000-memory.dmp
memory/4896-4-0x0000000000AE0000-0x0000000000B5A000-memory.dmp
memory/4896-0-0x0000000000AE0000-0x0000000000B5A000-memory.dmp
memory/5116-15-0x0000000000980000-0x00000000009FA000-memory.dmp
memory/5116-12-0x0000000000980000-0x00000000009FA000-memory.dmp
memory/5128-40-0x00000000009D0000-0x0000000000A4A000-memory.dmp
memory/5128-36-0x00000000009D0000-0x0000000000A4A000-memory.dmp
memory/5760-54-0x00000000009B0000-0x0000000000A2A000-memory.dmp
memory/5760-59-0x00000000009B0000-0x0000000000A2A000-memory.dmp
memory/6140-42-0x0000000000890000-0x000000000090A000-memory.dmp
memory/6140-46-0x0000000000890000-0x000000000090A000-memory.dmp