stormser | 7596f3f1c4ce29f816d1f2deaf5134f8c79357113d8ce14c435725d6e4165462

General

Target
2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe
Size 168KB
Sample260629-w79bjady8l
SHA256 7596f3f1c4ce29f816d1f2deaf5134f8c79357113d8ce14c435725d6e4165462
MD5 044b02761c6dfb5c10d9b2b7d1e5cc73
SHA1 34038b1e18edf2cf1a233dc8fd327909f9e05556
SHA512 d4efbe7565b7a47d70e7fc5754a8d9cdf40b3a713aaf2c7e53f37305ae2ba87cb774549fa50d513a58507797610652d4f25571d0dc24b139c78e5c4ebc55bac8
SSDEEP 1536:1EGh0oklq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oklqOPOe2MUVg3Ve+rX
TLSH
T101F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639D8C19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4a2-3.dat	family_stormser
behavioral2/files/0x000e00000001c4a3-6.dat	family_stormser
behavioral2/files/0x000f00000001c4a2-13.dat	family_stormser
behavioral2/files/0x000f00000001c4a3-18.dat	family_stormser
behavioral2/files/0x001000000001c4a2-23.dat	family_stormser

Auto-generated rule 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4a2-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001c4a3-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000001c4a2-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000001c4a3-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x001000000001c4a2-23.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CAC0D54-0FD4-4261-8282-7223B04EB73C}	2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CAC0D54-0FD4-4261-8282-7223B04EB73C}\stubpath = "C:\\Windows\\{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe"	2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9A83953-B55D-4455-9845-6B1D4F713B75}	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B9A83953-B55D-4455-9845-6B1D4F713B75}\stubpath = "C:\\Windows\\{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe"	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C20DD43B-A887-4955-90E9-FFB74FF2FD19}\stubpath = "C:\\Windows\\{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe"	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}\stubpath = "C:\\Windows\\{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe"	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C20DD43B-A887-4955-90E9-FFB74FF2FD19}	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}\stubpath = "C:\\Windows\\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe"	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe

Executes dropped EXE 6 IoCs

pid	Process
6056	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
1336	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
3896	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
5376	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe
2360	{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe
1168	{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe	2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe
File created	C:\Windows\{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
File created	C:\Windows\{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
File created	C:\Windows\{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
File created	C:\Windows\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3704578903-1610922810-1098216751-1000\{C009C950-B265-4C92-A89A-C26E47CFBD87}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4880	2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	6056	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
Token: SeIncBasePriorityPrivilege	1336	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
Token: SeIncBasePriorityPrivilege	3896	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
Token: SeIncBasePriorityPrivilege	5376	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe
Token: SeShutdownPrivilege	1600	explorer.exe
Token: SeCreatePagefilePrivilege	1600	explorer.exe
Token: SeShutdownPrivilege	1600	explorer.exe
Token: SeCreatePagefilePrivilege	1600	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3232	sihost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 6056	4880	2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe	87
PID 4880 wrote to memory of 5424	4880	2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe	88
PID 6056 wrote to memory of 1336	6056	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe	89
PID 6056 wrote to memory of 2496	6056	{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe	90
PID 1336 wrote to memory of 3896	1336	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe	91
PID 1336 wrote to memory of 3864	1336	{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe	92
PID 3896 wrote to memory of 5376	3896	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe	93
PID 3896 wrote to memory of 1440	3896	{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe	94
PID 5376 wrote to memory of 2360	5376	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe	95
PID 5376 wrote to memory of 5188	5376	{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe	96
PID 3232 wrote to memory of 1600	3232	sihost.exe	101
PID 1600 wrote to memory of 1168	1600	explorer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_044b02761c6dfb5c10d9b2b7d1e5cc73_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
  C:\Windows\{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
    C:\Windows\{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
      C:\Windows\{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe
        
        C:\Windows\{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5376
      - C:\Windows\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe
        
        C:\Windows\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2360
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{C20DD~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{45294~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B9A83~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6CAC0~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5424

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1600
- - C:\Windows\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe
    "C:\Windows\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe

Path C:\Windows\{4529411C-DA6A-43a4-99F7-5C8D1A42F2D6}.exe
Size 168KB
SHA256 013642ab2465b071e05e712b58ed9c5b24115e206c3c0eb6d0b115a7c2f98b40
MD5 a4864a9dad69852f5cfebefe6ad5d1c3
SHA1 b2f4b2fbeb8a6585b7239c98c2f23d5f26e6e1a2
SHA512 578515a8d2bc429899a4d73255226a563b4705dc0efc796dc6f69d70e9b8a9782969b02d2b49c7de6120a2a99c6320a086bc240474ea8c5ae8a32be0f75b5560
SSDEEP 1536:1EGh0ollq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ollqOPOe2MUVg3Ve+rX
TLSH
T13EF36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe

Path C:\Windows\{6CAC0D54-0FD4-4261-8282-7223B04EB73C}.exe
Size 168KB
SHA256 788cdb940c774217eae5e5716e28973a120cdf7aa328512e31c17b92e067a080
MD5 1c6735de67855f7de84a4e2e190d86dd
SHA1 a25df16354e92d5818103da7273b9a2e4e20f1c2
SHA512 cafca25020754f7f802d779835864086386f56c660fa6240272d62eed4b7a1504b3daba12af3f8d1e08f42b2665f1347bf25a794e35abb385d6cd41e07c8f381
SSDEEP 1536:1EGh0oUlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oUlqOPOe2MUVg3Ve+rX
TLSH
T1A0F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe

Path C:\Windows\{B237ACCA-9EC8-40a9-97FD-F6B43D398F58}.exe
Size 168KB
SHA256 834c071dc8a27d8f1e577acbc052264eb4b1ae7e936c734127e0a07c29cbb5d9
MD5 c4f6171234fc11700bc38b83875b7e1e
SHA1 794e68ca48913837889816f8849f876eb9bfab2a
SHA512 93ee559e23b8032987861133e2229d59a62c33c7e05eebea2e53820a0643dfa051964671f0a14f257596152f86c9a28f43476b6a770d2ab273f2dfb7dfa64734
SSDEEP 1536:1EGh0oqlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oqlqOPOe2MUVg3Ve+rX
TLSH
T13EF36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe

Path C:\Windows\{B9A83953-B55D-4455-9845-6B1D4F713B75}.exe
Size 168KB
SHA256 6f12953fc9e6c7e8052291a44a63d479628294e2e73f304fc552747eaceb3b7a
MD5 714165fdede7ff95bdc07ee27fea40ab
SHA1 95736700e9f48b5dc557fd2659bf9f6cc7d41a0b
SHA512 e244bfdea1b4b2ae0a398c5c5001f951d8ac3c595607b686d357acc9876e67152357fde493f5babe9d2d4db65b7b055efa2fa4ed3435248c701f06a445a91cf8
SSDEEP 1536:1EGh0oJlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oJlqOPOe2MUVg3Ve+rX
TLSH
T108F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe

Path C:\Windows\{C20DD43B-A887-4955-90E9-FFB74FF2FD19}.exe
Size 168KB
SHA256 bd7777b3279557e90cb61b14f3893bc76021e6deec66637c195774c3e2f5eab0
MD5 2d2e6d34dd9ecb8a92889d21c4db028d
SHA1 3207d317c7244bb0da88705fe631ad3467f8e830
SHA512 d53fed5d110a90411656ae95bf475ab462fc26eb13b86990156d011945d0f1972392e448bfe81c4d5c2284173d2ab011e5f06d8ce1c67d3821dca3e4dd74b000
SSDEEP 1536:1EGh0oYlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oYlqOPOe2MUVg3Ve+rX
TLSH
T19CF36B666B93E8E1D0D302340E64C5129A33FEE441B2962639D8C19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads