Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 15:15
General
- Target 2026-05-03_6853c81ff52e8e14ba8cfbe75b129404_elex_goldeneye_wannacry.exe
- Size 197KB
- Sample260503-smy4aaft4p
- SHA256 3b8204a07c1098ee3689a2664f450c3a95e0370a76e9e13687ff27f5f626f6c9
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_6853c81ff52e8e14ba8cfbe75b129404_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_6853c81ff52e8e14ba8cfbe75b129404_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1EA045F6-1804-498c-9119-9F07F4178ABA}.exeC:\Windows\{1EA045F6-1804-498c-9119-9F07F4178ABA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A3DE34B-455D-4190-AD8E-EFDAE2F39130}.exeC:\Windows\{7A3DE34B-455D-4190-AD8E-EFDAE2F39130}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{906C0E07-D944-4861-8A4B-33755E0779EB}.exeC:\Windows\{906C0E07-D944-4861-8A4B-33755E0779EB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19A5350E-E5D3-43e3-B587-2CB830F73680}.exeC:\Windows\{19A5350E-E5D3-43e3-B587-2CB830F73680}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CC507E5-1ED6-48a4-AC96-5ABD7F449534}.exeC:\Windows\{2CC507E5-1ED6-48a4-AC96-5ABD7F449534}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABAC6F4B-CC8D-40b5-BDF2-559C6008AFD6}.exeC:\Windows\{ABAC6F4B-CC8D-40b5-BDF2-559C6008AFD6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7318ABFC-920F-4a6f-A4E2-DB42B0924837}.exeC:\Windows\{7318ABFC-920F-4a6f-A4E2-DB42B0924837}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF058C9B-0F9D-4c45-A4C7-DCBF862EA843}.exeC:\Windows\{FF058C9B-0F9D-4c45-A4C7-DCBF862EA843}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9758BF09-2348-468e-9065-AFE927FA4460}.exeC:\Windows\{9758BF09-2348-468e-9065-AFE927FA4460}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EBC0929E-4351-426d-B9C3-C30F26D65DD6}.exeC:\Windows\{EBC0929E-4351-426d-B9C3-C30F26D65DD6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB9010C7-974A-4e2a-92FF-DEE9D182A057}.exeC:\Windows\{BB9010C7-974A-4e2a-92FF-DEE9D182A057}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EBC09~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9758B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF058~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7318A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABAC6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CC50~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19A53~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{906C0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A3DE~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EA04~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{19A5350E-E5D3-43e3-B587-2CB830F73680}.exe
{1EA045F6-1804-498c-9119-9F07F4178ABA}.exe
{2CC507E5-1ED6-48a4-AC96-5ABD7F449534}.exe
{7318ABFC-920F-4a6f-A4E2-DB42B0924837}.exe
{7A3DE34B-455D-4190-AD8E-EFDAE2F39130}.exe
{906C0E07-D944-4861-8A4B-33755E0779EB}.exe
{9758BF09-2348-468e-9065-AFE927FA4460}.exe
{ABAC6F4B-CC8D-40b5-BDF2-559C6008AFD6}.exe
{BB9010C7-974A-4e2a-92FF-DEE9D182A057}.exe
{EBC0929E-4351-426d-B9C3-C30F26D65DD6}.exe
{FF058C9B-0F9D-4c45-A4C7-DCBF862EA843}.exe
memory/988-46-0x00000000008A0000-0x0000000000B2B000-memory.dmp
memory/988-42-0x00000000008A0000-0x0000000000B2B000-memory.dmp
memory/1728-48-0x0000000000870000-0x0000000000AFB000-memory.dmp
memory/1728-52-0x0000000000870000-0x0000000000AFB000-memory.dmp
memory/1772-12-0x0000000000A00000-0x0000000000C8B000-memory.dmp
memory/1772-16-0x0000000000A00000-0x0000000000C8B000-memory.dmp
memory/2488-54-0x0000000000930000-0x0000000000BBB000-memory.dmp
memory/2488-58-0x0000000000930000-0x0000000000BBB000-memory.dmp
memory/2976-18-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/2976-22-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/3116-4-0x0000000000AD0000-0x0000000000D5B000-memory.dmp
memory/3116-0-0x0000000000AD0000-0x0000000000D5B000-memory.dmp
memory/3168-34-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/3168-30-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/4360-64-0x0000000000850000-0x0000000000ADB000-memory.dmp
memory/4360-60-0x0000000000850000-0x0000000000ADB000-memory.dmp
memory/4628-24-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/4628-28-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/4684-10-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/4684-6-0x0000000000840000-0x0000000000ACB000-memory.dmp
memory/5080-40-0x00000000008B0000-0x0000000000B3B000-memory.dmp
memory/5080-36-0x00000000008B0000-0x0000000000B3B000-memory.dmp