stormser | 8d489dcef7c8bf85fa1fb8d5fdfa0132fe788cce8f28fbe0f517dec3c57bd82a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe
Size 380KB
Sample260424-vwglpsez7x
SHA256 8d489dcef7c8bf85fa1fb8d5fdfa0132fe788cce8f28fbe0f517dec3c57bd82a
MD5 f11eaab5321cfc17a268bb0634a6548c
SHA1 5ef2ab5ff959072242441f87721d0f0bfcfa724e
SHA512 641cf7a78723e9dd98d4eb561f0bcf1c913149c334a81547a1994d1392434c08f1a1bb997eb0b0f81e63b458c02521ee70e6011a3cba748b867e593543ba9e02
SSDEEP 3072:mEGh0oalPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGEl7Oe2MUVg3v2IneKcAEcARy
TLSH
T1FB84953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 9 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b1b9-2.dat	family_stormser
behavioral2/files/0x001a00000002b301-7.dat	family_stormser
behavioral2/files/0x002100000002b1b9-10.dat	family_stormser
behavioral2/files/0x001b00000002b301-14.dat	family_stormser
behavioral2/files/0x002200000002b1b9-18.dat	family_stormser
behavioral2/files/0x001c00000002b301-22.dat	family_stormser
behavioral2/files/0x002300000002b1b9-26.dat	family_stormser
behavioral2/files/0x0003000000024fa0-30.dat	family_stormser
behavioral2/files/0x0003000000024fa1-35.dat	family_stormser

Auto-generated rule 9 IoCs

resource	yara_rule
behavioral2/files/0x002000000002b1b9-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001a00000002b301-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x002100000002b1b9-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001b00000002b301-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x002200000002b1b9-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001c00000002b301-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x002300000002b1b9-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000024fa0-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0003000000024fa1-35.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCBB7F30-AC05-4ad2-860C-481100A7A377}\stubpath = "C:\\Windows\\{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe"	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}\stubpath = "C:\\Windows\\{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe"	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}\stubpath = "C:\\Windows\\{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe"	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1806980C-6569-49fa-8188-6B52F5D9B45D}\stubpath = "C:\\Windows\\{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe"	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}	2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{267B857F-E713-441c-BE7B-978C8D0594B3}	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}\stubpath = "C:\\Windows\\{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe"	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}\stubpath = "C:\\Windows\\{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe"	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{267B857F-E713-441c-BE7B-978C8D0594B3}\stubpath = "C:\\Windows\\{267B857F-E713-441c-BE7B-978C8D0594B3}.exe"	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}\stubpath = "C:\\Windows\\{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe"	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1806980C-6569-49fa-8188-6B52F5D9B45D}	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}\stubpath = "C:\\Windows\\{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe"	2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FCBB7F30-AC05-4ad2-860C-481100A7A377}	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe

Executes dropped EXE 9 IoCs

pid	Process
3992	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
3316	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
2412	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
3024	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
2156	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
924	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
4764	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
5112	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
4792	{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
File created	C:\Windows\{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
File created	C:\Windows\{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
File created	C:\Windows\{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
File created	C:\Windows\{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe	2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe
File created	C:\Windows\{267B857F-E713-441c-BE7B-978C8D0594B3}.exe	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
File created	C:\Windows\{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
File created	C:\Windows\{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
File created	C:\Windows\{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4932	2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	3992	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
Token: SeIncBasePriorityPrivilege	3316	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
Token: SeIncBasePriorityPrivilege	2412	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
Token: SeIncBasePriorityPrivilege	3024	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
Token: SeIncBasePriorityPrivilege	2156	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
Token: SeIncBasePriorityPrivilege	924	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
Token: SeIncBasePriorityPrivilege	4764	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
Token: SeIncBasePriorityPrivilege	5112	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3992	4932	2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe	80
PID 4932 wrote to memory of 3476	4932	2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe	81
PID 3992 wrote to memory of 3316	3992	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe	82
PID 3992 wrote to memory of 2348	3992	{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe	83
PID 3316 wrote to memory of 2412	3316	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe	84
PID 3316 wrote to memory of 2632	3316	{267B857F-E713-441c-BE7B-978C8D0594B3}.exe	85
PID 2412 wrote to memory of 3024	2412	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe	86
PID 2412 wrote to memory of 2968	2412	{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe	87
PID 3024 wrote to memory of 2156	3024	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe	88
PID 3024 wrote to memory of 1124	3024	{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe	89
PID 2156 wrote to memory of 924	2156	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe	90
PID 2156 wrote to memory of 1736	2156	{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe	91
PID 924 wrote to memory of 4764	924	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe	92
PID 924 wrote to memory of 4840	924	{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe	93
PID 4764 wrote to memory of 5112	4764	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe	94
PID 4764 wrote to memory of 4392	4764	{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe	95
PID 5112 wrote to memory of 4792	5112	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe	96
PID 5112 wrote to memory of 4188	5112	{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_f11eaab5321cfc17a268bb0634a6548c_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
  C:\Windows\{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
    C:\Windows\{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
      C:\Windows\{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Windows\{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
        
        C:\Windows\{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3024
      - C:\Windows\{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
        
        C:\Windows\{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
        
        C:\Windows\{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
        7⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
        
        C:\Windows\{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
        8⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
        
        C:\Windows\{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
        9⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe
        
        C:\Windows\{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe
        10⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4792
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{951D9~1.EXE > nul
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{18069~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{4E995~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{89AA6~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1736
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FCBB7~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{84B2D~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{267B8~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{E782F~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe

Path C:\Windows\{1806980C-6569-49fa-8188-6B52F5D9B45D}.exe
Size 380KB
SHA256 cd5bb3aa78e8743c9fb4c3e5692264156df96819ba0ec7028f09fad8c6c80541
MD5 603c041bebd179ed3c6837833b532d7a
SHA1 076331f3181e91fafe69d9a9b972d2ca61e59f94
SHA512 2a99d66f2a968d54af8222a584f87ae1c5fc6c89892cc2b9c8d17f68a4226ce33d8190a41ded82d8e50221746a04cdbde13ae0bc111041b65a1abf329d8ef95e
SSDEEP 3072:mEGh0oUlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGCl7Oe2MUVg3v2IneKcAEcARy
TLSH
T15E84953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F008A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{267B857F-E713-441c-BE7B-978C8D0594B3}.exe

Path C:\Windows\{267B857F-E713-441c-BE7B-978C8D0594B3}.exe
Size 380KB
SHA256 6d13b64c4b93c71d2a67e1288e7142dcde830685b234aa7cebaac980f049f701
MD5 d17e279d5bc1e86eb9a543a58120bba2
SHA1 06a2a9cb94081a3aecf204ae566acafa01d5a8bf
SHA512 90a2a17200497f6f18f3a4c8f872c97dfd01d3e1c27e08700562a9af84a7e0a0b55750c40ed2601e7623567cf1a1131fe7b558a285a1ad62260a0f5da6fa834e
SSDEEP 3072:mEGh0oTlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGpl7Oe2MUVg3v2IneKcAEcARy
TLSH
T18784953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe

Path C:\Windows\{4E9956E5-FFAD-42ca-93F7-F8D107B2856E}.exe
Size 380KB
SHA256 ac32f582923d1e6670232185316a9c742c826c5a1ce12142d31d6a9055260156
MD5 6d6f0dc100d7a178356e7c0a9c17051c
SHA1 edd58e7360768a1b3d931cca9df87209f07658e6
SHA512 a18d96efe95332945bb8b48de2f06c78a053b056f257d2895e92b17630609f1fcc8e5c9a6d1afa0e04a116fff3e032eeea2711ee6cbb08933b2f77b58c965af6
SSDEEP 3072:mEGh0oIlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGCl7Oe2MUVg3v2IneKcAEcARy
TLSH
T1F284953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe

Path C:\Windows\{84B2D1CE-04EA-4ede-984B-A54F63E0BC28}.exe
Size 380KB
SHA256 2c0b1dd4d0e7da8c4c232e095c368b9213379d34b455f2f41a5998af97393b77
MD5 adae84bbc3f345c4ab01a767d6c845ac
SHA1 1539b4ef0241f6cd7e24180ce7b56a50ef69f8e4
SHA512 9dfe69ee119debf02080e0a036a9ec4011d53ca5f948c23b5b9d306eeafd991cee6c910b92982777d222db5c0ea5b8ae4562c549a12782b0fa7ba3859bf1aa13
SSDEEP 3072:mEGh0oXlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGFl7Oe2MUVg3v2IneKcAEcARy
TLSH
T17A84953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe

Path C:\Windows\{89AA6D8C-1DF3-4185-966A-FABA6F9B74AB}.exe
Size 380KB
SHA256 5f3b4df8ecf704a1fb4e992f0db7e63bc980cc07d1775f8b3434afed8843fe0f
MD5 6a3309dfde37aa34d16bed21b3108b8f
SHA1 ba6518038f0df6f5b008b1ad74f866674eebceb6
SHA512 8615fffc2136ef704a767045eb7b1308635ed7cfc37424f92253002e3274704f1c0a3b8805d801956d5b6820df02c5f6677b8a2135c9b67b2986c9dc140a9f50
SSDEEP 3072:mEGh0ohlPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGDl7Oe2MUVg3v2IneKcAEcARy
TLSH
T19984953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe

Path C:\Windows\{951D944B-FD68-4eb3-AF46-AD1CF4BE7015}.exe
Size 380KB
SHA256 5772833f385ec73db537bda3189cd7f0e267f9473b25d15c9786baa7ca7b4fb9
MD5 5692280e2548e36749af7a6e8fb68904
SHA1 e1afe95e972fc83fb8c634c14a7ae64140af5ddf
SHA512 c1922a8ab4642c9eaf94295ac71bd72dd32c43c3d52d62970122fcb53543d87b7c3775a2b33a66c330470728e309ba36bbe84951077255067b87f7140b456f22
SSDEEP 3072:mEGh0o+lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGYl7Oe2MUVg3v2IneKcAEcARy
TLSH
T15E84953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe

Path C:\Windows\{D2A4DFB6-FC9C-46bb-9C13-4515DAC8FCB8}.exe
Size 380KB
SHA256 b8672baf2f224626cda0e15713febd4586c8df033327a47cd37dfc822df14d80
MD5 aa4569277b8363e6c94cc44c67d613cd
SHA1 27aaee548677e714dcc9705a208ce651294223fe
SHA512 bfce6a9b224984e16b33c98074a554a6ffe45bff86fb05e26b9c48e725e94d67c85116927c785f9576e5e555b419641830b75e9259162d91ab5527f43d935c7c
SSDEEP 3072:mEGh0o0lPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGil7Oe2MUVg3v2IneKcAEcARy
TLSH
T17084953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe

Path C:\Windows\{E782F9D7-A3EF-482b-AE6B-A404CECBCB45}.exe
Size 380KB
SHA256 65bad0b4fbb33c85f4a29543ca240865baa6f1cdd2d1c2cbd96ee962d1ada2a7
MD5 68e695be8f08294eb713804a90b0a413
SHA1 a1e4dc35c52e9cdd5701b7deddb3f6f2de60035c
SHA512 3429c95cb8783ffecf8af1286ab5075679898f36bfb72012ee0aea748fb31b18ed9e7f80c78b7bd88b07e7f3fdb4e76e9c315ec8f3ddb2fdf0392cb5e04c178e
SSDEEP 3072:mEGh0oblPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGVl7Oe2MUVg3v2IneKcAEcARy
TLSH
T1C384953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe

Path C:\Windows\{FCBB7F30-AC05-4ad2-860C-481100A7A377}.exe
Size 380KB
SHA256 d006109a1e60772ec322e4034e4ce5a679e6a9f1d785a74b6b7eced2c865484b
MD5 5b0c1fef12fddc57fb57065ca59d9728
SHA1 4656da809e5312631b398361d5bf32fff791b219
SHA512 989816cf869d1b6c88187f87191e3cbc02bd5d6b4fefa089490aaa7ce51a4e06c41cadb10957ba7bc154ebec47400d67b4a7ea66a6cd469a652614f283f8df92
SSDEEP 3072:mEGh0oylPOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGw:mEGMl7Oe2MUVg3v2IneKcAEcARy
TLSH
T12B84953D6FE5D5B5E0B34B704DB5C101A9BBBE913931CE1F108A511E8C21AE09DA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads