stormser | 0b01af6791be8184ee1d32e7e4e71039c41e2c89e4209c7ed88f0738f572f93b

General

Target
2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe
Size 168KB
Sample260729-mlareaek7x
SHA256 0b01af6791be8184ee1d32e7e4e71039c41e2c89e4209c7ed88f0738f572f93b
MD5 cc5751ff4d9f72cc9291d45672968b02
SHA1 96dc703561d7f69e4b019686f70ee79a14ba7aed
SHA512 b3fd7f953f117cb7d0bc8c3926db51972bfe5731c07efa0bb5f2a3a9693005702cda0054c60b5d408d53047b6ad912fc98990630db801e7d67d235c77ab5c271
SSDEEP 1536:1EGh0otlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0otlqOPOe2MUVg3Ve+rX
TLSH
T1BBF36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024583-2.dat	family_stormser
behavioral1/files/0x000700000002458e-6.dat	family_stormser
behavioral1/files/0x000500000001e44f-10.dat	family_stormser

Auto-generated rule 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024583-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000700000002458e-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000500000001e44f-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}\stubpath = "C:\\Windows\\{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe"	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59B6D675-F49B-4f67-9479-68F2864C6E63}	2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{59B6D675-F49B-4f67-9479-68F2864C6E63}\stubpath = "C:\\Windows\\{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe"	2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}\stubpath = "C:\\Windows\\{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe"	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe

Executes dropped EXE 3 IoCs

pid	Process
5716	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
5820	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe
5020	{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe	2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe
File created	C:\Windows\{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
File created	C:\Windows\{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5460	cmd.exe
5728	cmd.exe
1408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4568	2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	5716	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
Token: SeIncBasePriorityPrivilege	5820	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 5716	4568	2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe	92
PID 4568 wrote to memory of 5728	4568	2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe	93
PID 5716 wrote to memory of 5820	5716	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe	97
PID 5716 wrote to memory of 1408	5716	{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe	98
PID 5820 wrote to memory of 5020	5820	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe	102
PID 5820 wrote to memory of 5460	5820	{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_cc5751ff4d9f72cc9291d45672968b02_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
  C:\Windows\{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5716
- - C:\Windows\{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe
    C:\Windows\{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe
      C:\Windows\{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5020
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8B0A3~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{59B6D~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe

Path C:\Windows\{59B6D675-F49B-4f67-9479-68F2864C6E63}.exe
Size 168KB
SHA256 a5e65b5a49adce7a393caef522a4a40256b960ab0fb1e85525e351989e7906ce
MD5 f041c0060b1b4f48b3f64330aef88c4a
SHA1 7ba2d8d0f7b4581ea4ed1682fb6543b8fd896221
SHA512 ba8815fea73565fbc5feddb24a32da495fbe1175683022705b4a1c13490fb9859a4994c604f3c97f6e3a91a016aeab42eb0529111ce6fe966a28cf301d841836
SSDEEP 1536:1EGh0ohlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0ohlqOPOe2MUVg3Ve+rX
TLSH
T160F36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe

Path C:\Windows\{8B0A37DE-9CF4-4297-8486-7E8E60A7D205}.exe
Size 168KB
SHA256 784bb52db1e32a1a8ef6b6f40fce8a4fe3c660e57ef3083d12c4152298014f47
MD5 7fb310ab3ae4e68341144741bd8d6ef6
SHA1 e8e79a0f49f7d6ca6b5885abc1af000fd46955ea
SHA512 9b013b62f0a3f2c654104b34d648b31c67971acc8e9a96cd257c900935e6b84071e9584d1945a45c502085e2954a94fcaeca268482d5beb7fc2e4a009b5aff31
SSDEEP 1536:1EGh0oNlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oNlqOPOe2MUVg3Ve+rX
TLSH
T16AF36B666B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0EE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe

Path C:\Windows\{D014BF06-AC36-4d7f-86B2-E9CA1D355D16}.exe
Size 168KB
SHA256 eca9ec9f987561cf8fead00a5f190a1bd9d551a04a3072f249ad6bfec9c2d768
MD5 4ff83c892ae942f7726e86ae26f5716d
SHA1 2097fe979135d24b738ff227069b2788ca336ae4
SHA512 ba80d67477ba60dadb1d607f0b1886fe76e0e7857bdee9cec3fbe8157eadc1ef296ff3b12c6fc6c46dcccd4ea9919f96a9064ced7827f229af4276356b5ad2ef
SSDEEP 1536:1EGh0oVlq5IRVhNJ5Qef7BudMeNzVg3Ve+rrS2:1EGh0oVlqOPOe2MUVg3Ve+rX
TLSH
T1D1F36BA66B93E8E1D0D302340E64C5129A33FEE441B2962639DCC19DCDD59B0DE7E72E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads