stormser | 015995d01191d9f296368a949d50394a014c0c1cf430735b81897551ca5b2923

General

Target
2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe
Size 344KB
Sample260709-fs5f2adw81
SHA256 015995d01191d9f296368a949d50394a014c0c1cf430735b81897551ca5b2923
MD5 6cecdae841f29edba521253baa4b5bd6
SHA1 2f1e27f4ade91a541b567cdaf640a98ee543aec4
SHA512 77fae6d3f2fb7e30e95b33f4453620bb53e529c0a27b7a8a2c5ee205b0a9dedb5573496bd9a74944d60ffe55fa49d2dd699d169861ddb5e1a7db48741f4fc31e
SSDEEP 3072:mEGh0ozlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGplqOe2MUVg3v2IneKcAEcA
TLSH
T1AF74923A6FE5D9E4F0B34B714DB5C20065BBBEA06A71CB1F109E505E8C21AE08D66737
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4c3-3.dat	family_stormser
behavioral2/files/0x000e00000001c4c4-6.dat	family_stormser
behavioral2/files/0x000f00000001c4c3-13.dat	family_stormser

Auto-generated rule 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4c3-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001c4c4-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000001c4c3-13.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{865086C6-3231-4c4b-885B-7297A197D591}\stubpath = "C:\\Windows\\{865086C6-3231-4c4b-885B-7297A197D591}.exe"	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FB96923-EA99-4a45-A937-54C9BAE172B3}	2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8FB96923-EA99-4a45-A937-54C9BAE172B3}\stubpath = "C:\\Windows\\{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe"	2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}\stubpath = "C:\\Windows\\{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe"	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{865086C6-3231-4c4b-885B-7297A197D591}	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe

Executes dropped EXE 4 IoCs

pid	Process
2272	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
4952	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
4848	{865086C6-3231-4c4b-885B-7297A197D591}.exe
1108	{865086C6-3231-4c4b-885B-7297A197D591}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{865086C6-3231-4c4b-885B-7297A197D591}.exe	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
File created	C:\Windows\{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe	2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe
File created	C:\Windows\{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{865086C6-3231-4c4b-885B-7297A197D591}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{865086C6-3231-4c4b-885B-7297A197D591}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{827E56BF-F6CD-4D8E-8A8A-67B52710E07A}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4832	2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	2272	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
Token: SeIncBasePriorityPrivilege	4952	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
Token: SeShutdownPrivilege	1364	explorer.exe
Token: SeCreatePagefilePrivilege	1364	explorer.exe
Token: SeShutdownPrivilege	1364	explorer.exe
Token: SeCreatePagefilePrivilege	1364	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3524	sihost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2272	4832	2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe	88
PID 4832 wrote to memory of 4336	4832	2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe	89
PID 2272 wrote to memory of 4952	2272	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe	90
PID 2272 wrote to memory of 4660	2272	{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe	91
PID 4952 wrote to memory of 4848	4952	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe	92
PID 4952 wrote to memory of 5564	4952	{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe	93
PID 3524 wrote to memory of 1364	3524	sihost.exe	98
PID 1364 wrote to memory of 1108	1364	explorer.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_6cecdae841f29edba521253baa4b5bd6_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
  C:\Windows\{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
    C:\Windows\{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\{865086C6-3231-4c4b-885B-7297A197D591}.exe
      C:\Windows\{865086C6-3231-4c4b-885B-7297A197D591}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4848
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D1DE6~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5564
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8FB96~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4336

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\{865086C6-3231-4c4b-885B-7297A197D591}.exe
    "C:\Windows\{865086C6-3231-4c4b-885B-7297A197D591}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{865086C6-3231-4c4b-885B-7297A197D591}.exe

Path C:\Windows\{865086C6-3231-4c4b-885B-7297A197D591}.exe
Size 344KB
SHA256 660b3ae4ebc1988a611ef0b71bda4dc5858e50388faad39683939c3c6991237e
MD5 6620272fdb8602808885b2db0dc32039
SHA1 3fa6b1f45f9bbdf3270eb112f35f80f4aecc4f5c
SHA512 31998e26df05a24718922faa5b36ad8a09f870985e8cf259a499774026c7b07f0455056048bf3c35bbed0f85812e2dbcd821fe49913131a322ee105ce04e9fea
SSDEEP 3072:mEGh0otlEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGPlqOe2MUVg3v2IneKcAEcA
TLSH
T18E74923A6FE5D9E4F0B34B714DB5C20065BBBEA06A71CB1F109E505E8C21AE08D66737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe

Path C:\Windows\{8FB96923-EA99-4a45-A937-54C9BAE172B3}.exe
Size 344KB
SHA256 89d98fc565688fee82d58ef6a8f33246360fd3846b192c91c4d302491a09dd2a
MD5 732a3fd8350a3ef53b994ea2a82213cf
SHA1 d3621105b43e505c1136fca79cdc3305c37848b3
SHA512 be4aa1c6a127f9d00f165797ab183ed643e32db06fbdc60d5156d6206ed29a80fb60cdca4fa60ce2713d5866dcd68dc19e5dc3cfa9357a88c75037955fe6f83e
SSDEEP 3072:mEGh0oblEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGxlqOe2MUVg3v2IneKcAEcA
TLSH
T10B74923A6FE5D9E4F0B34B714DB5C20065BBBEA06A71CB1F109E505E8C21AE08D66737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe

Path C:\Windows\{D1DE6FE8-832F-4e0e-8877-FD9611699AC7}.exe
Size 344KB
SHA256 f2b8f4a843cba6d0928e5fe7ca13e696cb96348abfe4bee35d7701b213bb4dd1
MD5 c4b4a1c33a8efa5b4ef0f108e68e26a1
SHA1 8210c5f80669569709fbb444b40b8a8ca01b328d
SHA512 be4a7e79f2c4af0b4c0167af9b87ace1e756e2d7eee88213ea15adbf470fe22f58807e57bf1d40171e628de1e823d092112d354293b8b6af1b4699f0ad6c6aaa
SSDEEP 3072:mEGh0oalEOiDOe2MUVg3bHrH/HqOYGb+4QnZZIne+rcC4F0fJGRIS8Rfd7eQEcGL:mEGclqOe2MUVg3v2IneKcAEcA
TLSH
T10B74923A6FE5D9E4F0B34B714DB5C20065BBBEA06A71CB1F109E505E8C21AE08D66737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads