stormser | 5bd9516dd4e19c714760e5c54e51b39ac9f39f47085701ace323bc208536b8cd

General

Target
2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe
Size 168KB
Sample260629-2562aahv41
SHA256 5bd9516dd4e19c714760e5c54e51b39ac9f39f47085701ace323bc208536b8cd
MD5 34916e5d458f2d1e3ac1e945a1c034e7
SHA1 55ec9a1b5a9bb0baf145c6ecf367b9918be857c8
SHA512 4c2adaa16e543fe988209bf2e2e4f817a0fc3ed1a8c07d059b6f77be1153263041d4c0b187588594e4789d226e6ac192e1e7722eeeb764c78ed84c1241e10804
SSDEEP 1536:1EGh0oYlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oYlqOPOe2MUVg3Ve+rX
TLSH
T158F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c2f2-3.dat	family_stormser
behavioral2/files/0x000e00000001c2f3-6.dat	family_stormser
behavioral2/files/0x000f00000001c2f2-13.dat	family_stormser
behavioral2/files/0x000f00000001c2f3-18.dat	family_stormser
behavioral2/files/0x001000000001c2f2-23.dat	family_stormser

Auto-generated rule 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c2f2-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001c2f3-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000001c2f2-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000001c2f3-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001000000001c2f2-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{299EE6A4-ADCD-4e01-BAB6-A191F6345212}	2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B68C8341-A712-4dcb-B7E6-4EE18C72072F}\stubpath = "C:\\Windows\\{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe"	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CB70555-8148-43ca-B1C3-3CFC62987B75}	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CB70555-8148-43ca-B1C3-3CFC62987B75}\stubpath = "C:\\Windows\\{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe"	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2163BA40-2BDF-4876-866E-EE7187CE4F9A}\stubpath = "C:\\Windows\\{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe"	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}\stubpath = "C:\\Windows\\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe"	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{299EE6A4-ADCD-4e01-BAB6-A191F6345212}\stubpath = "C:\\Windows\\{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe"	2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B68C8341-A712-4dcb-B7E6-4EE18C72072F}	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2163BA40-2BDF-4876-866E-EE7187CE4F9A}	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe

Executes dropped EXE 6 IoCs

pid	Process
6032	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
1944	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
1552	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
4876	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe
1812	{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe
2812	{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe	2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe
File created	C:\Windows\{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
File created	C:\Windows\{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
File created	C:\Windows\{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
File created	C:\Windows\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{609AE784-77DC-4CF6-860A-67B86A2F278A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4668	2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	6032	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
Token: SeIncBasePriorityPrivilege	1944	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
Token: SeIncBasePriorityPrivilege	1552	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
Token: SeIncBasePriorityPrivilege	4876	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe
Token: SeShutdownPrivilege	3172	explorer.exe
Token: SeCreatePagefilePrivilege	3172	explorer.exe
Token: SeShutdownPrivilege	3172	explorer.exe
Token: SeCreatePagefilePrivilege	3172	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3364	sihost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 6032	4668	2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe	87
PID 4668 wrote to memory of 5744	4668	2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe	88
PID 6032 wrote to memory of 1944	6032	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe	89
PID 6032 wrote to memory of 4200	6032	{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe	90
PID 1944 wrote to memory of 1552	1944	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe	91
PID 1944 wrote to memory of 1596	1944	{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe	92
PID 1552 wrote to memory of 4876	1552	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe	93
PID 1552 wrote to memory of 1876	1552	{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe	94
PID 4876 wrote to memory of 1812	4876	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe	95
PID 4876 wrote to memory of 4980	4876	{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe	96
PID 3364 wrote to memory of 3172	3364	sihost.exe	101
PID 3172 wrote to memory of 2812	3172	explorer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_34916e5d458f2d1e3ac1e945a1c034e7_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
  C:\Windows\{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
    C:\Windows\{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
      C:\Windows\{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe
        
        C:\Windows\{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4876
      - C:\Windows\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe
        
        C:\Windows\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1812
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2163B~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4980
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{6CB70~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1876
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B68C8~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1596
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{299EE~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5744

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe
    "C:\Windows\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe

Path C:\Windows\{2163BA40-2BDF-4876-866E-EE7187CE4F9A}.exe
Size 168KB
SHA256 d2f111441323cc15cfcad97923f610a918f8e646b24bc8cff02c0c9047b5a624
MD5 a05ed90f67a9b237d5cf69b9c86d3afc
SHA1 dc18d32ce0680f9a8af38b458d39af89e8e80123
SHA512 5550cfb8e4eb8a46839909e9bde4b9381ff98fb41ebc06097a36ef38feb010e693a71f9617f3c06f782c733fccaacc089c198e54e064f98c6f32041f42b473c0
SSDEEP 1536:1EGh0oplq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oplqOPOe2MUVg3Ve+rX
TLSH
T11CF36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe

Path C:\Windows\{299EE6A4-ADCD-4e01-BAB6-A191F6345212}.exe
Size 168KB
SHA256 92e6bd75d62194af02e7d6b136387a538623ea18194851db1c671d47457e550a
MD5 96f9ed00e74cde23e80d366c92f8483c
SHA1 1873ecad2cdb4e5358aa22fb0a51e9ea32266e2a
SHA512 df3c94377e538302a37d22844c4572e7ec0ed49ca9057b58599b1958e7b465b717ad7b609be758d02ffc815baa4d12da28edf14ab6f0c08bfbe7763d97adaebd
SSDEEP 1536:1EGh0oelq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oelqOPOe2MUVg3Ve+rX
TLSH
T15BF36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe

Path C:\Windows\{6CB70555-8148-43ca-B1C3-3CFC62987B75}.exe
Size 168KB
SHA256 f558c5d73616be975bb4342b41f62665e27daece9474bbc29d4a4416033369bd
MD5 30361de843138ddc60e83b574b09ca49
SHA1 2fd46c9b68fe17b8ac2a97e49c1d982117144427
SHA512 c04a93aec6cbc4ffe944d42c7a737f6bc4b5ad19db7fbb2f3d48ce84e49f1a2ee9ceacee24c77963126d6b42d8d7e9081999b0e691e2ed7abd7e95e697515ac3
SSDEEP 1536:1EGh0oolq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oolqOPOe2MUVg3Ve+rX
TLSH
T147F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe

Path C:\Windows\{B68C8341-A712-4dcb-B7E6-4EE18C72072F}.exe
Size 168KB
SHA256 c14a5dc1e584bc953762f58dabdf8226efd998941545bd9a72926f16e33c245f
MD5 3819a4370f3b846e44a07d78091a18f6
SHA1 1e500a7513487f1878422e709329505635085ce8
SHA512 d8db72f991208a1b5693e8b520ba01ceeff832d6076695e32a1f746c428a3f6367da81e67494640cfd010a5b13d4b139ff6a4130c7df42dd3ec8b6486a5974e3
SSDEEP 1536:1EGh0oelq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oelqOPOe2MUVg3Ve+rX
TLSH
T176F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0DE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe

Path C:\Windows\{DB185EBD-19F6-4576-BD9F-AA5136E7B10B}.exe
Size 168KB
SHA256 79edfc8dc3350b09ce23366d82e7d2d8b0aab17863bb483ef65ddda8b8d6d046
MD5 a8be0f9f1a8c733ed9eb0da71eafd66a
SHA1 910a5d169db4f839f72386bd3048c97a604c92ae
SHA512 a12a1d7cba3b5640db66ec5097c4738301ae2e2e0eb6e078dc8a8211cbfab5fa454cdef635ece37f516d6d94335630bf5825f8e708b4b603b00663c8b1408cd3
SSDEEP 1536:1EGh0oRlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oRlqOPOe2MUVg3Ve+rX
TLSH
T119F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads