Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 15:01
General
- Target 2026-05-03_474f0f3e233ded7aff5b223e898ca8f6_elex_goldeneye_wannacry.exe
- Size 168KB
- Sample260503-sdvdqse15m
- SHA256 e51b9f7e7d422c57cb5f5f521fa5ca6b2bd719f051e540fddd9847bc884b22ee
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Auto-generated rule 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_474f0f3e233ded7aff5b223e898ca8f6_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_474f0f3e233ded7aff5b223e898ca8f6_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{028192EA-4D94-4bb3-A87F-B5EF98389E9D}.exeC:\Windows\{028192EA-4D94-4bb3-A87F-B5EF98389E9D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E694CE3-F11A-4fed-9DD0-4563E9B37A5F}.exeC:\Windows\{2E694CE3-F11A-4fed-9DD0-4563E9B37A5F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4CD81CF-CCC1-4fe0-BDD7-3C4012C5B421}.exeC:\Windows\{E4CD81CF-CCC1-4fe0-BDD7-3C4012C5B421}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DFFC710B-725D-4e0f-BEF8-7716CC10E122}.exeC:\Windows\{DFFC710B-725D-4e0f-BEF8-7716CC10E122}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0E2DE52-ED96-421c-AD08-4FAD720140EE}.exeC:\Windows\{F0E2DE52-ED96-421c-AD08-4FAD720140EE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1999C1D5-72D3-4c29-9E5D-FFB908F179F7}.exeC:\Windows\{1999C1D5-72D3-4c29-9E5D-FFB908F179F7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7903CBC0-CDC2-43bd-94C0-73A0ABF7917F}.exeC:\Windows\{7903CBC0-CDC2-43bd-94C0-73A0ABF7917F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{26741A04-B86A-42e4-92B2-0ADB6BAF929A}.exeC:\Windows\{26741A04-B86A-42e4-92B2-0ADB6BAF929A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A0B0A4C-9E99-46f3-AED3-4A4E7F797285}.exeC:\Windows\{3A0B0A4C-9E99-46f3-AED3-4A4E7F797285}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5398A59F-91D3-4e18-B702-D225283433C2}.exeC:\Windows\{5398A59F-91D3-4e18-B702-D225283433C2}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A0B0~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{26741~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7903C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1999C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0E2D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFFC7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4CD8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E694~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02819~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{028192EA-4D94-4bb3-A87F-B5EF98389E9D}.exe
{1999C1D5-72D3-4c29-9E5D-FFB908F179F7}.exe
{26741A04-B86A-42e4-92B2-0ADB6BAF929A}.exe
{2E694CE3-F11A-4fed-9DD0-4563E9B37A5F}.exe
{3A0B0A4C-9E99-46f3-AED3-4A4E7F797285}.exe
{5398A59F-91D3-4e18-B702-D225283433C2}.exe
{7903CBC0-CDC2-43bd-94C0-73A0ABF7917F}.exe
{DFFC710B-725D-4e0f-BEF8-7716CC10E122}.exe
{E4CD81CF-CCC1-4fe0-BDD7-3C4012C5B421}.exe
{F0E2DE52-ED96-421c-AD08-4FAD720140EE}.exe
memory/1100-29-0x00000000008C0000-0x00000000009D2000-memory.dmp
memory/1100-25-0x00000000008C0000-0x00000000009D2000-memory.dmp
memory/1948-37-0x0000000000880000-0x0000000000992000-memory.dmp
memory/1948-40-0x0000000000880000-0x0000000000992000-memory.dmp
memory/3252-31-0x0000000000B40000-0x0000000000C52000-memory.dmp
memory/3252-35-0x0000000000B40000-0x0000000000C52000-memory.dmp
memory/3260-13-0x0000000000860000-0x0000000000972000-memory.dmp
memory/3260-16-0x0000000000860000-0x0000000000972000-memory.dmp
memory/3340-0-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/3340-6-0x0000000000980000-0x0000000000A92000-memory.dmp
memory/4356-49-0x0000000000900000-0x0000000000A12000-memory.dmp
memory/4356-53-0x0000000000900000-0x0000000000A12000-memory.dmp
memory/4980-23-0x0000000000860000-0x0000000000972000-memory.dmp
memory/4980-19-0x0000000000860000-0x0000000000972000-memory.dmp
memory/5188-11-0x00000000009C0000-0x0000000000AD2000-memory.dmp
memory/5188-7-0x00000000009C0000-0x0000000000AD2000-memory.dmp
memory/5548-43-0x00000000008B0000-0x00000000009C2000-memory.dmp
memory/5548-47-0x00000000008B0000-0x00000000009C2000-memory.dmp
memory/5812-55-0x0000000000A50000-0x0000000000B62000-memory.dmp
memory/5812-59-0x0000000000A50000-0x0000000000B62000-memory.dmp