Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 15:47
General
- Target 2026-05-04_ab8f2433487976127313ed9344df31e7_elex_goldeneye_wannacry.exe
- Size 180KB
- Sample260504-s8ea1aa12j
- SHA256 a53a372f2e8dee75158f121263f805767e7b7c9db0b9bbb086c6b9bd33b2b346
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_ab8f2433487976127313ed9344df31e7_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_ab8f2433487976127313ed9344df31e7_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3E6D15A6-28B7-43e6-8DE7-DBFF9154F725}.exeC:\Windows\{3E6D15A6-28B7-43e6-8DE7-DBFF9154F725}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58581F91-7AAF-4dc5-B927-8E6421B58302}.exeC:\Windows\{58581F91-7AAF-4dc5-B927-8E6421B58302}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4521375-81CD-475f-9933-7B53508F9392}.exeC:\Windows\{E4521375-81CD-475f-9933-7B53508F9392}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35622DF0-3ACF-401c-8EAE-571E3AFC6821}.exeC:\Windows\{35622DF0-3ACF-401c-8EAE-571E3AFC6821}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FA3C74E-4E02-48ea-9411-10AE5532C513}.exeC:\Windows\{4FA3C74E-4E02-48ea-9411-10AE5532C513}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C21BB4F0-E2EA-47a7-91A5-22A859E15C45}.exeC:\Windows\{C21BB4F0-E2EA-47a7-91A5-22A859E15C45}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A421B1C1-3C96-4a83-88E7-2AA4210B66B8}.exeC:\Windows\{A421B1C1-3C96-4a83-88E7-2AA4210B66B8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39E83C2E-6F81-473e-BA7F-57903B1AE838}.exeC:\Windows\{39E83C2E-6F81-473e-BA7F-57903B1AE838}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11EDD1A9-B732-4707-ACF6-9FE571CEF1AD}.exeC:\Windows\{11EDD1A9-B732-4707-ACF6-9FE571CEF1AD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5674CA3F-3EC2-4893-A11E-280A5AADF7A8}.exeC:\Windows\{5674CA3F-3EC2-4893-A11E-280A5AADF7A8}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FC277E1-10CD-4c91-AD52-32436AA181E2}.exeC:\Windows\{6FC277E1-10CD-4c91-AD52-32436AA181E2}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5674C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11EDD~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39E83~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A421B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C21BB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FA3C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35622~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4521~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{58581~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3E6D1~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{11EDD1A9-B732-4707-ACF6-9FE571CEF1AD}.exe
{35622DF0-3ACF-401c-8EAE-571E3AFC6821}.exe
{39E83C2E-6F81-473e-BA7F-57903B1AE838}.exe
{3E6D15A6-28B7-43e6-8DE7-DBFF9154F725}.exe
{4FA3C74E-4E02-48ea-9411-10AE5532C513}.exe
{5674CA3F-3EC2-4893-A11E-280A5AADF7A8}.exe
{58581F91-7AAF-4dc5-B927-8E6421B58302}.exe
{6FC277E1-10CD-4c91-AD52-32436AA181E2}.exe
{A421B1C1-3C96-4a83-88E7-2AA4210B66B8}.exe
{C21BB4F0-E2EA-47a7-91A5-22A859E15C45}.exe
{E4521375-81CD-475f-9933-7B53508F9392}.exe
memory/1384-17-0x00000000007D0000-0x0000000000857000-memory.dmp
memory/1384-12-0x00000000007D0000-0x0000000000857000-memory.dmp
memory/1820-36-0x0000000000950000-0x00000000009D7000-memory.dmp
memory/1820-41-0x0000000000950000-0x00000000009D7000-memory.dmp
memory/1972-54-0x0000000000450000-0x00000000004D7000-memory.dmp
memory/1972-59-0x0000000000450000-0x00000000004D7000-memory.dmp
memory/2056-48-0x00000000009D0000-0x0000000000A57000-memory.dmp
memory/2056-52-0x00000000009D0000-0x0000000000A57000-memory.dmp
memory/2364-64-0x0000000000540000-0x00000000005C7000-memory.dmp
memory/2364-60-0x0000000000540000-0x00000000005C7000-memory.dmp
memory/3396-28-0x0000000000640000-0x00000000006C7000-memory.dmp
memory/3396-24-0x0000000000640000-0x00000000006C7000-memory.dmp
memory/3744-46-0x00000000008F0000-0x0000000000977000-memory.dmp
memory/3744-42-0x00000000008F0000-0x0000000000977000-memory.dmp
memory/3804-21-0x0000000000570000-0x00000000005F7000-memory.dmp
memory/3804-18-0x0000000000570000-0x00000000005F7000-memory.dmp
memory/4088-30-0x0000000000880000-0x0000000000907000-memory.dmp
memory/4088-34-0x0000000000880000-0x0000000000907000-memory.dmp
memory/4312-0-0x0000000000A00000-0x0000000000A87000-memory.dmp
memory/4312-5-0x0000000000A00000-0x0000000000A87000-memory.dmp
memory/4500-9-0x0000000000880000-0x0000000000907000-memory.dmp
memory/4500-6-0x0000000000880000-0x0000000000907000-memory.dmp