Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 16:16
General
- Target 2026-05-11_8c00490ebd1f4c5f5c4a7d87c04971a6_elex_goldeneye_wannacry.exe
- Size 180KB
- Sample260511-tqwb8set4w
- SHA256 57c56d74b0befdb784ffd1920b64f65aa6921d29d34f299a439a17fd5ea3d335
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_8c00490ebd1f4c5f5c4a7d87c04971a6_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_8c00490ebd1f4c5f5c4a7d87c04971a6_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC9C7F2F-4D15-495b-88B9-0D3CCF3D6DC6}.exeC:\Windows\{DC9C7F2F-4D15-495b-88B9-0D3CCF3D6DC6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1061CA74-3ADF-4a21-9784-2F6F2A342ED0}.exeC:\Windows\{1061CA74-3ADF-4a21-9784-2F6F2A342ED0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F83E2BF-BCE8-4959-8387-9DDA92AE8EE3}.exeC:\Windows\{2F83E2BF-BCE8-4959-8387-9DDA92AE8EE3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C95C0B20-9259-4251-B4C4-B667893E88E6}.exeC:\Windows\{C95C0B20-9259-4251-B4C4-B667893E88E6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1880412E-911C-41e5-AE17-BB077F9B776A}.exeC:\Windows\{1880412E-911C-41e5-AE17-BB077F9B776A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B41B994B-AF0D-4fd8-8C21-F9FD0BDCE423}.exeC:\Windows\{B41B994B-AF0D-4fd8-8C21-F9FD0BDCE423}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C03CC24-E2EA-4147-B391-534295C1BDD5}.exeC:\Windows\{1C03CC24-E2EA-4147-B391-534295C1BDD5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6419F571-E7BE-4519-A289-0F70E7A1B0AB}.exeC:\Windows\{6419F571-E7BE-4519-A289-0F70E7A1B0AB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C44346DE-7495-4069-B733-0D87E420F567}.exeC:\Windows\{C44346DE-7495-4069-B733-0D87E420F567}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18C7D78B-9BAE-432a-8FB6-161D40B90013}.exeC:\Windows\{18C7D78B-9BAE-432a-8FB6-161D40B90013}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECB527E2-4FC7-4a8f-848F-6F62223F8873}.exeC:\Windows\{ECB527E2-4FC7-4a8f-848F-6F62223F8873}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18C7D~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4434~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6419F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C03C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B41B9~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18804~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C95C0~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F83E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1061C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC9C7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1061CA74-3ADF-4a21-9784-2F6F2A342ED0}.exe
{1880412E-911C-41e5-AE17-BB077F9B776A}.exe
{18C7D78B-9BAE-432a-8FB6-161D40B90013}.exe
{1C03CC24-E2EA-4147-B391-534295C1BDD5}.exe
{2F83E2BF-BCE8-4959-8387-9DDA92AE8EE3}.exe
{6419F571-E7BE-4519-A289-0F70E7A1B0AB}.exe
{B41B994B-AF0D-4fd8-8C21-F9FD0BDCE423}.exe
{C44346DE-7495-4069-B733-0D87E420F567}.exe
{C95C0B20-9259-4251-B4C4-B667893E88E6}.exe
{DC9C7F2F-4D15-495b-88B9-0D3CCF3D6DC6}.exe
{ECB527E2-4FC7-4a8f-848F-6F62223F8873}.exe
memory/844-6-0x0000000000880000-0x000000000095F000-memory.dmp
memory/844-10-0x0000000000880000-0x000000000095F000-memory.dmp
memory/2964-54-0x0000000000860000-0x000000000093F000-memory.dmp
memory/2964-58-0x0000000000860000-0x000000000093F000-memory.dmp
memory/3052-17-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/3052-12-0x0000000000990000-0x0000000000A6F000-memory.dmp
memory/3096-34-0x0000000000850000-0x000000000092F000-memory.dmp
memory/3096-30-0x0000000000850000-0x000000000092F000-memory.dmp
memory/3352-22-0x0000000000870000-0x000000000094F000-memory.dmp
memory/3352-18-0x0000000000870000-0x000000000094F000-memory.dmp
memory/3428-36-0x0000000000890000-0x000000000096F000-memory.dmp
memory/3428-39-0x0000000000890000-0x000000000096F000-memory.dmp
memory/4012-64-0x00000000009D0000-0x0000000000AAF000-memory.dmp
memory/4012-60-0x00000000009D0000-0x0000000000AAF000-memory.dmp
memory/4320-0-0x0000000000AC0000-0x0000000000B9F000-memory.dmp
memory/4320-4-0x0000000000AC0000-0x0000000000B9F000-memory.dmp
memory/4480-24-0x0000000000840000-0x000000000091F000-memory.dmp
memory/4480-28-0x0000000000840000-0x000000000091F000-memory.dmp
memory/5708-52-0x0000000000840000-0x000000000091F000-memory.dmp
memory/5708-48-0x0000000000840000-0x000000000091F000-memory.dmp
memory/5872-46-0x0000000000850000-0x000000000092F000-memory.dmp
memory/5872-42-0x0000000000850000-0x000000000092F000-memory.dmp