Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 16:47
General
- Target 2026-04-24_0a5b6dba7f7294e77253c69bc1960ad6_elex_goldeneye_wannacry.exe
- Size 204KB
- Sample260424-vapp7aex3w
- SHA256 3f3f3cf43e0edeb618236523714f3245ed34b0743bcbbeaf457d4dc4488a00c4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureAuto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_0a5b6dba7f7294e77253c69bc1960ad6_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_0a5b6dba7f7294e77253c69bc1960ad6_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1036EFAB-CC6D-431a-8043-D86ABEFBD9D7}.exeC:\Windows\{1036EFAB-CC6D-431a-8043-D86ABEFBD9D7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{900BFA14-6E67-4d18-99A0-84767411A099}.exeC:\Windows\{900BFA14-6E67-4d18-99A0-84767411A099}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E48FF6C9-8D9F-4496-B2A4-4B96F61BFD09}.exeC:\Windows\{E48FF6C9-8D9F-4496-B2A4-4B96F61BFD09}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FFE045B-853D-4187-9CE7-FFDC281F4C73}.exeC:\Windows\{7FFE045B-853D-4187-9CE7-FFDC281F4C73}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07CFEB87-D9E3-4d44-94C2-35C9A8BAAEA3}.exeC:\Windows\{07CFEB87-D9E3-4d44-94C2-35C9A8BAAEA3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0092209F-6D69-45c7-AB41-1E0A945B8132}.exeC:\Windows\{0092209F-6D69-45c7-AB41-1E0A945B8132}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52AE69F1-C787-4b62-BA9D-0684051A51B2}.exeC:\Windows\{52AE69F1-C787-4b62-BA9D-0684051A51B2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8A598C1-CCEC-4922-B958-E4EAFF290CB5}.exeC:\Windows\{A8A598C1-CCEC-4922-B958-E4EAFF290CB5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEA54731-41A9-4b70-ABA0-1E673FB4EF37}.exeC:\Windows\{AEA54731-41A9-4b70-ABA0-1E673FB4EF37}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48BB40FA-C0E7-483e-9FCB-9C644F051521}.exeC:\Windows\{48BB40FA-C0E7-483e-9FCB-9C644F051521}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CD5843D-B75E-48da-AC22-F40062BD5855}.exeC:\Windows\{8CD5843D-B75E-48da-AC22-F40062BD5855}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48BB4~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEA54~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8A59~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52AE6~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00922~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07CFE~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FFE0~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E48FF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{900BF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1036E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0092209F-6D69-45c7-AB41-1E0A945B8132}.exe
{07CFEB87-D9E3-4d44-94C2-35C9A8BAAEA3}.exe
{1036EFAB-CC6D-431a-8043-D86ABEFBD9D7}.exe
{48BB40FA-C0E7-483e-9FCB-9C644F051521}.exe
{52AE69F1-C787-4b62-BA9D-0684051A51B2}.exe
{7FFE045B-853D-4187-9CE7-FFDC281F4C73}.exe
{8CD5843D-B75E-48da-AC22-F40062BD5855}.exe
{900BFA14-6E67-4d18-99A0-84767411A099}.exe
{A8A598C1-CCEC-4922-B958-E4EAFF290CB5}.exe
{AEA54731-41A9-4b70-ABA0-1E673FB4EF37}.exe
{E48FF6C9-8D9F-4496-B2A4-4B96F61BFD09}.exe
memory/688-60-0x0000000000760000-0x00000000009E1000-memory.dmp
memory/688-64-0x0000000000760000-0x00000000009E1000-memory.dmp
memory/1552-48-0x0000000000760000-0x00000000009E1000-memory.dmp
memory/1552-51-0x0000000000760000-0x00000000009E1000-memory.dmp
memory/1956-24-0x0000000000790000-0x0000000000A11000-memory.dmp
memory/1956-28-0x0000000000790000-0x0000000000A11000-memory.dmp
memory/3312-42-0x00000000007C0000-0x0000000000A41000-memory.dmp
memory/3312-46-0x00000000007C0000-0x0000000000A41000-memory.dmp
memory/3396-30-0x00000000007C0000-0x0000000000A41000-memory.dmp
memory/3396-34-0x00000000007C0000-0x0000000000A41000-memory.dmp
memory/4268-36-0x0000000000870000-0x0000000000AF1000-memory.dmp
memory/4268-41-0x0000000000870000-0x0000000000AF1000-memory.dmp
memory/4308-0-0x00000000009F0000-0x0000000000C71000-memory.dmp
memory/4308-5-0x00000000009F0000-0x0000000000C71000-memory.dmp
memory/4484-16-0x0000000000760000-0x00000000009E1000-memory.dmp
memory/4484-12-0x0000000000760000-0x00000000009E1000-memory.dmp
memory/4628-54-0x00000000007A0000-0x0000000000A21000-memory.dmp
memory/4628-57-0x00000000007A0000-0x0000000000A21000-memory.dmp
memory/4640-11-0x0000000000770000-0x00000000009F1000-memory.dmp
memory/4640-6-0x0000000000770000-0x00000000009F1000-memory.dmp
memory/5268-18-0x0000000000770000-0x00000000009F1000-memory.dmp
memory/5268-23-0x0000000000770000-0x00000000009F1000-memory.dmp