stormser | c175c9697e74ed7bb991d38b3637d4be889e2925faee534ee5e71efd8478780d

General

Target
2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe
Size 192KB
Sample260708-wpzdlsfs5v
SHA256 c175c9697e74ed7bb991d38b3637d4be889e2925faee534ee5e71efd8478780d
MD5 4686a4ab2e51111ae0156dce5f7c3540
SHA1 69062de1640c553745f3cab86cdc427e072bb660
SHA512 00a85a8bc1a72739e22b60e2e1c22a0566448f6aa4418e7e51a1ea103f798e33e5f8f8d032cd41881eb97c713eafc1214949f6829744934b1752503408c4ce2d
SSDEEP 1536:1EGh0oyl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oyl1OPOe2MUVg3Ve+rXfMUa
TLSH
T106142B3D6FD3D4F2D0B3C2344AB08593FE23BE9231614E1E25D543458D92A62EDAAE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c441-3.dat	family_stormser
behavioral2/files/0x000e00000001c442-6.dat	family_stormser
behavioral2/files/0x000e00000001c444-13.dat	family_stormser
behavioral2/files/0x000f00000001c442-18.dat	family_stormser

Auto-generated rule 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c441-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001c442-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001c444-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000001c442-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}\stubpath = "C:\\Windows\\{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe"	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}\stubpath = "C:\\Windows\\{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe"	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}\stubpath = "C:\\Windows\\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe"	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FAEED25-6658-4d60-876A-312F09BC7149}	2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FAEED25-6658-4d60-876A-312F09BC7149}\stubpath = "C:\\Windows\\{8FAEED25-6658-4d60-876A-312F09BC7149}.exe"	2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe

Executes dropped EXE 5 IoCs

pid	Process
3664	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
3124	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
4660	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
6132	{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe
3728	{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
File created	C:\Windows\{8FAEED25-6658-4d60-876A-312F09BC7149}.exe	2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe
File created	C:\Windows\{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
File created	C:\Windows\{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{49BB4797-B3F0-42F6-89CF-2BC187B2A86E}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3668	2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	3664	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
Token: SeIncBasePriorityPrivilege	3124	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
Token: SeIncBasePriorityPrivilege	4660	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
Token: SeShutdownPrivilege	4832	explorer.exe
Token: SeCreatePagefilePrivilege	4832	explorer.exe
Token: SeShutdownPrivilege	4832	explorer.exe
Token: SeCreatePagefilePrivilege	4832	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 3664	3668	2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe	88
PID 3668 wrote to memory of 1172	3668	2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe	89
PID 3664 wrote to memory of 3124	3664	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe	90
PID 3664 wrote to memory of 2332	3664	{8FAEED25-6658-4d60-876A-312F09BC7149}.exe	91
PID 3124 wrote to memory of 4660	3124	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe	93
PID 3124 wrote to memory of 4824	3124	{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe	94
PID 4660 wrote to memory of 6132	4660	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe	95
PID 4660 wrote to memory of 2484	4660	{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe	96
PID 2196 wrote to memory of 4832	2196	sihost.exe	101
PID 4832 wrote to memory of 3728	4832	explorer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_4686a4ab2e51111ae0156dce5f7c3540_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Windows\{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
  C:\Windows\{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
    C:\Windows\{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Windows\{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
      C:\Windows\{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4660
    - - C:\Windows\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe
        
        C:\Windows\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6132
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E3E0A~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2484
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8DEAC~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8FAEE~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2332
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1172

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe
    "C:\Windows\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe

Path C:\Windows\{0E77ABE8-C23D-4196-ACAA-F75E5B4DCB8A}.exe
Size 192KB
SHA256 d8cb0507b15f5ba3537c9c279a2ec05b9180fb33aaa892608f81bc6058ada72f
MD5 d3ca9d9e5a9a1541d06c0e1c7ada661a
SHA1 bd5a8cbfdf38dc04c27c108e4c5a78dc86fd457b
SHA512 da4f734fc4207345987633f651936f829b0dfd72fdbead80d3ef58a6e86df228f379a57ddf1f5807f35acaa054158d20c9d4cd4d2e55385b82f3be3c6180c88d
SSDEEP 1536:1EGh0oHl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oHl1OPOe2MUVg3Ve+rXfMUa
TLSH
T160142B3D6FD3D4F2D0B3C2344AB08593FE23BE9231614E1E25D543458D92A62EDAAE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe

Path C:\Windows\{8DEACA85-D77A-45e1-A1AB-CD731F0894B5}.exe
Size 192KB
SHA256 4b0cde15ac3b2da9605acf8267132d733a7272f3147cea4826a853678ec0dda4
MD5 f2d68aee1360cb0904084676cf8ed5ad
SHA1 13e5e20c8cbaa8d9727433b92b6bc979cd7a6162
SHA512 09a4fd5af7aba110cc0dffbd69d34dd2cb86d7b01bd676882f359c1541d811b5826342a94b473f81fb4cd1f54fff37dd60020f08d5525fd8f918d0c832664c82
SSDEEP 1536:1EGh0okl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0okl1OPOe2MUVg3Ve+rXfMUa
TLSH
T11A142B3D6FD3D4F2D0B3C2344AB08593FE23BE9231614E1E25D543458D92A62EDAAE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8FAEED25-6658-4d60-876A-312F09BC7149}.exe

Path C:\Windows\{8FAEED25-6658-4d60-876A-312F09BC7149}.exe
Size 192KB
SHA256 356ecd08a23a87e2a7e0ddc9a3264f11678711b3b2c267f513ae94fcfcf7e190
MD5 f87076284e58465681a6a92872772c4a
SHA1 9f525b085963a63f83f1fbbafcb719597fffc320
SHA512 3f51d16d4f18777ed83e790bcd3022b3eba14e6aeb87e1e9deab4262df47e93f3074eeb326ba653a700800d4d54bfa551f92de6b9a1d95eb60a2febfc4aadcad
SSDEEP 1536:1EGh0ooLl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0o0l1OPOe2MUVg3Ve+rXfMUa
TLSH
T1BE142B3D6FD3D4F2D0B3C2344AB08593FE23BE9231614E1E25D543458D92A62EDAAE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe

Path C:\Windows\{E3E0A8B3-DFA2-47ec-AE68-DDEAC7A483A7}.exe
Size 192KB
SHA256 3c4c4c84ae13c231c328d090c0322ba98f8c3c98249a0488e98671b85fd8a3b7
MD5 6b9fb13915d631ca5e5c1fd6cb29b0b2
SHA1 2a440fe51df73aee8fbaa94da8e2ceb04895895f
SHA512 c87678c8008257ea3223a63449cea8f592acae4dbe0ac5c08488e3c84ed530b76a62b722212c260143a5854660068e70c370463eaa4d08b3243257655a974a03
SSDEEP 1536:1EGh0oxl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3H6:1EGh0oxl1OPOe2MUVg3Ve+rXfMUa
TLSH
T14F142B3D6FD3D4F2D0B382344AB08593FE23BE9231614E1E25D543458D92A62EDAAF1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads