stormser | 35805d1f0a8036d03e4be7a8362f24ad9bfc3bcc00de9846d8517f8d05eb3d25

General

Target
2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe
Size 180KB
Sample260730-ejh11abd48
SHA256 35805d1f0a8036d03e4be7a8362f24ad9bfc3bcc00de9846d8517f8d05eb3d25
MD5 079c71912d5970cd5645edf0f4311e9c
SHA1 ab03d306eaac91de3236725d1fefafcf97d5c7ef
SHA512 b2156ae9ac6a474579bd4216f502bd5a765a3fde09e35950382ca4a3fa3b5a16505dc431f78dffb43356c38dec5fae09fda12283c006ca25e6d118023fbc020c
SSDEEP 3072:jEGh0oilfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGQl5eKcAEc
TLSH
T13904E52233F94A24F4F31B355CB5C451AA37BFA1AA76D91D22C8405D4A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x00030000000006d5-2.dat	family_stormser
behavioral1/files/0x0006000000016805-7.dat	family_stormser
behavioral1/files/0x000600000001d89a-8.dat	family_stormser
behavioral1/files/0x000400000001e6b7-14.dat	family_stormser

Auto-generated rule 4 IoCs

resource	yara_rule
behavioral1/files/0x00030000000006d5-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0006000000016805-7.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000600000001d89a-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000400000001e6b7-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}\stubpath = "C:\\Windows\\{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe"	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC7AC0E1-A9E4-425c-8169-F9E79005092A}	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DC7AC0E1-A9E4-425c-8169-F9E79005092A}\stubpath = "C:\\Windows\\{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe"	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19100AEE-1512-468e-9D06-07F9286CA279}	2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{19100AEE-1512-468e-9D06-07F9286CA279}\stubpath = "C:\\Windows\\{19100AEE-1512-468e-9D06-07F9286CA279}.exe"	2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}	{19100AEE-1512-468e-9D06-07F9286CA279}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}\stubpath = "C:\\Windows\\{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe"	{19100AEE-1512-468e-9D06-07F9286CA279}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe

Executes dropped EXE 4 IoCs

pid	Process
5084	{19100AEE-1512-468e-9D06-07F9286CA279}.exe
2232	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
3192	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe
1404	{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{19100AEE-1512-468e-9D06-07F9286CA279}.exe	2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe
File created	C:\Windows\{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe	{19100AEE-1512-468e-9D06-07F9286CA279}.exe
File created	C:\Windows\{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
File created	C:\Windows\{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4664	cmd.exe
392	cmd.exe
2500	cmd.exe
3984	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{19100AEE-1512-468e-9D06-07F9286CA279}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1592	2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	5084	{19100AEE-1512-468e-9D06-07F9286CA279}.exe
Token: SeIncBasePriorityPrivilege	2232	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
Token: SeIncBasePriorityPrivilege	3192	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 5084	1592	2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe	89
PID 1592 wrote to memory of 4664	1592	2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe	90
PID 5084 wrote to memory of 2232	5084	{19100AEE-1512-468e-9D06-07F9286CA279}.exe	91
PID 5084 wrote to memory of 392	5084	{19100AEE-1512-468e-9D06-07F9286CA279}.exe	92
PID 2232 wrote to memory of 3192	2232	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe	95
PID 2232 wrote to memory of 2500	2232	{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe	96
PID 3192 wrote to memory of 1404	3192	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe	102
PID 3192 wrote to memory of 3984	3192	{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_079c71912d5970cd5645edf0f4311e9c_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\{19100AEE-1512-468e-9D06-07F9286CA279}.exe
  C:\Windows\{19100AEE-1512-468e-9D06-07F9286CA279}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
    C:\Windows\{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe
      C:\Windows\{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3192
    - - C:\Windows\{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe
        
        C:\Windows\{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{B6F3B~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3984
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{C4B09~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{19100~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{19100AEE-1512-468e-9D06-07F9286CA279}.exe

Path C:\Windows\{19100AEE-1512-468e-9D06-07F9286CA279}.exe
Size 180KB
SHA256 3c0553c61e55a77bb0159f6bff82071a0adaeda1b03f87a1bfd9c963f5a35ae4
MD5 cf193941d88d9131223a2e0a940b00c2
SHA1 3280cc9c4bc9ba4e89658d6f419e22693d51d5e6
SHA512 2fb80126faddbc97cb6e0b8b6671bac9caddc6dd9afa19375a80036443c6d78a57861646486376777e5f6b26474800f9cb93fd16caec30b07a04d6e06f84f609
SSDEEP 3072:jEGh0oblfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGJl5eKcAEc
TLSH
T18F04E42233F94A24F4F31B355CB5C451AA37BFA1AA76D91D22C8405D4A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe

Path C:\Windows\{B6F3B87B-67CB-4e5f-997D-9B82ADDC54A1}.exe
Size 180KB
SHA256 633d30d206843e85ef9a7564ec478335b37baa0f5fff1532542ef50520c69262
MD5 d677ec22ceabfd9047c3f7d8c500d961
SHA1 c7fd44d8adafc1edab4efb8e86f6134169cdde45
SHA512 5a391bef084d8ac8443633d5227c7f1ff102eae45db63c5f3454bcce4eb0e9bdf7bc251446b2d34921631bc526298d73a5c01398363db148ed4402ae51485386
SSDEEP 3072:jEGh0oDlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEG5l5eKcAEc
TLSH
T17504E52233F94A24F4F31B355CB5C451AA37BFA1AA76D91D22C8405D4A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe

Path C:\Windows\{C4B09D0F-0F7E-4eff-ABA7-45F9DD2A1E13}.exe
Size 180KB
SHA256 20d661d148a0bcf806390a4fb95a1f10af5884a8dc290b49d518ce7c6de75cc8
MD5 24c89022cd0e85909638c323d0e243ff
SHA1 29a612e3a746eb707ad35966dd01bd7a1899ae31
SHA512 1666ccdf87913003fe9c31875e9f46fb6f6105fcf773eda95e578875203f38e64ae4032a3a2fcd7650a2a692a4055ef46856098f9565ced3c834b71bea045a25
SSDEEP 3072:jEGh0oflfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGdl5eKcAEc
TLSH
T15304E42233F94A24F4F31B355CB5C451AA37BFA1AA76D91D22C8405D4A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe

Path C:\Windows\{DC7AC0E1-A9E4-425c-8169-F9E79005092A}.exe
Size 180KB
SHA256 0ed01720612935df7579d4d18d4e3088ea52051c82e5a99163f8c14533996847
MD5 4c2dc85d8fe19f289ac13212b0fd3585
SHA1 22182f9f9956566275b54dec3791e17692e1986c
SHA512 28972d5d814791fbdf244dc07bbf70aa48d2b13ed120ae544f411dd6daf89ec12474ac441dd2bf4773da519a287ef078870e69e50ffdbc4037ab0bf2de61569b
SSDEEP 3072:jEGh0oWlfOso7ie+rcC4F0fJGRIS8Rfd7eQEcGcr:jEGgl5eKcAEc
TLSH
T1C004E42233F94A24F4F31B355CB5C451AA37BFA1AA76D91D22C8405D4A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads