stormser | 6be6223bd6b38a61c41e0c00b370737e1c40f9123dffa32d63bbff53e654e8ef

General

Target
2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe
Size 197KB
Sample261027-nkm6satvbx
SHA256 6be6223bd6b38a61c41e0c00b370737e1c40f9123dffa32d63bbff53e654e8ef
MD5 9601bd40e1f5ef27ff658f06467eb8b2
SHA1 84c681f77e5683b509311d6a16f8d0213d2d741b
SHA512 9da27aad881053e976e27e05597855151f676b19fa89b50885b3cee3a11ffd7983cea87685288ba7965d5fb939095dbc1fcad4d8b893c5aa50e950e3204ff901
SSDEEP 3072:jEGh0o2l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGclEeKcAEca
TLSH
T13C14B32527E54626F0F39B3588B08092AE37BF927A75DD1D21C8414D4A33B81DEA5F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 6 IoCs

resource	yara_rule
behavioral1/files/0x000f000000024671-2.dat	family_stormser
behavioral1/files/0x0008000000024662-6.dat	family_stormser
behavioral1/files/0x0008000000024679-10.dat	family_stormser
behavioral1/files/0x0009000000024662-14.dat	family_stormser
behavioral1/files/0x0002000000021f67-18.dat	family_stormser
behavioral1/files/0x00030000000006d3-22.dat	family_stormser

Auto-generated rule 6 IoCs

resource	yara_rule
behavioral1/files/0x000f000000024671-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000024662-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000024679-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000024662-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0002000000021f67-18.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x00030000000006d3-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C32E1E2-852A-4384-A42D-74997B8D5DBD}\stubpath = "C:\\Windows\\{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe"	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBB9DE66-5EFB-42f2-AD71-164231B152A5}	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FBB9DE66-5EFB-42f2-AD71-164231B152A5}\stubpath = "C:\\Windows\\{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe"	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADC948D7-0467-481c-914D-B5EC90DCC318}	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADC948D7-0467-481c-914D-B5EC90DCC318}\stubpath = "C:\\Windows\\{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe"	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADBA5029-803F-4acd-B80A-2D963570EBE5}	2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{ADBA5029-803F-4acd-B80A-2D963570EBE5}\stubpath = "C:\\Windows\\{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe"	2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E850BD03-563E-4535-B92C-AFC307AB9F00}	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E850BD03-563E-4535-B92C-AFC307AB9F00}\stubpath = "C:\\Windows\\{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe"	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DA32AA5-8852-44b2-B4D2-D4560800F449}	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5DA32AA5-8852-44b2-B4D2-D4560800F449}\stubpath = "C:\\Windows\\{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe"	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0C32E1E2-852A-4384-A42D-74997B8D5DBD}	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe

Executes dropped EXE 6 IoCs

pid	Process
5204	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
5144	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
5088	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
4144	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
2132	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe
3720	{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe	2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe
File created	C:\Windows\{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
File created	C:\Windows\{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
File created	C:\Windows\{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
File created	C:\Windows\{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
File created	C:\Windows\{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5708	cmd.exe
3756	cmd.exe
2016	cmd.exe
2300	cmd.exe
452	cmd.exe
3676	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1124	2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	5204	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
Token: SeIncBasePriorityPrivilege	5144	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
Token: SeIncBasePriorityPrivilege	5088	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
Token: SeIncBasePriorityPrivilege	4144	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
Token: SeIncBasePriorityPrivilege	2132	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 5204	1124	2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe	92
PID 1124 wrote to memory of 5708	1124	2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe	93
PID 5204 wrote to memory of 5144	5204	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe	94
PID 5204 wrote to memory of 3756	5204	{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe	95
PID 5144 wrote to memory of 5088	5144	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe	99
PID 5144 wrote to memory of 2016	5144	{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe	100
PID 5088 wrote to memory of 4144	5088	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe	101
PID 5088 wrote to memory of 2300	5088	{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe	102
PID 4144 wrote to memory of 2132	4144	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe	103
PID 4144 wrote to memory of 452	4144	{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe	104
PID 2132 wrote to memory of 3720	2132	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe	105
PID 2132 wrote to memory of 3676	2132	{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_9601bd40e1f5ef27ff658f06467eb8b2_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
  C:\Windows\{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
    C:\Windows\{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\Windows\{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
      C:\Windows\{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Windows\{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
        
        C:\Windows\{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4144
      - C:\Windows\{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe
        
        C:\Windows\{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe
        
        C:\Windows\{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3720
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{ADC94~1.EXE > nul
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3676
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FBB9D~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:452
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0C32E~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2300
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{5DA32~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{ADBA5~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe

Path C:\Windows\{0C32E1E2-852A-4384-A42D-74997B8D5DBD}.exe
Size 197KB
SHA256 77e020af9cc78aca9b576eb2fa5aca016849be56124844aaeddc092bba411566
MD5 3934fe960d8910a98b6e751fe67966ca
SHA1 0567a529dfa6273414762901ef7f066f73039225
SHA512 f1f5c47f05de585d1e4c357f212dbc513110a2e17346761210cc626cb5ad0cc698dda0933f8f53d9754001337243024fd74caf7e7c52a9342ac3c150ea87c8ff
SSDEEP 3072:jEGh0oyl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGslEeKcAEca
TLSH
T12714B32527E54626F0F39B3588B08092AE37BF927A75DD1D21C8414D4A33B81DEA5F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe

Path C:\Windows\{5DA32AA5-8852-44b2-B4D2-D4560800F449}.exe
Size 197KB
SHA256 2f6534f8546b23af917b2baee9617ddd2b7be8bbabbf614cacf1ad8bfab0c8c0
MD5 ad6a02f540e14d98a93e3472d839096e
SHA1 453f3777f7fdddb0ad83f58060d8a590d5650b85
SHA512 521b623d5b2e9ae9a9c45b5d30a1717570abba7a0c3b43a8ccc4c57a90692031577f5a3dda1fedf04b6703bf552815f31e060dea36956926130f8c7bf4444d85
SSDEEP 3072:jEGh0o1l+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGXlEeKcAEca
TLSH
T10914B32527E54626F0F39B3588B08092AE37BF927A75DD1D21C8414D4A33B81DEA5F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe

Path C:\Windows\{ADBA5029-803F-4acd-B80A-2D963570EBE5}.exe
Size 197KB
SHA256 366f565a7a7753be054a4c1905ef1e86c64048c228c6f7d10182e713b4364de2
MD5 02ba310652079c2ea9ae3380b3418f92
SHA1 8c6a1c88833bc89545cc80b02efd7a0350e41298
SHA512 46a375a819b8959ee4067628ba5b54ff533d31bf4ab018575ff1cb01cde43d458fbdffaa9a2245f5b5fe138591be3776e613c995e03c0c8b386439bde4594cd2
SSDEEP 3072:jEGh0ofl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGZlEeKcAEca
TLSH
T14214B32527E54626F0F39B3588B08092AE37BF927A75DD1D21C8414D4A33B81DEA5F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe

Path C:\Windows\{ADC948D7-0467-481c-914D-B5EC90DCC318}.exe
Size 197KB
SHA256 083960e10db7471c6fea9199cbb25220ada5786bae99838ae76233d8eaaf8ea5
MD5 0185fc3b65288ffd05d132ce7c8b1e37
SHA1 533299b4403d11ea3b920a6f108dcd8afe23ccb1
SHA512 faa61f7ec638ef39468c00025279e99752dbaf3acd673dc82710aa3a052c5a05422cc18d6fe76a5eb56c2af391003d1bffb7e38124ca573a4491d0b9bfa773a8
SSDEEP 3072:jEGh0odl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGzlEeKcAEca
TLSH
T16914B32527E54626F0F39B3588B08092AE37BF927A75DD1D21C8414D4A33B81DEA5F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe

Path C:\Windows\{E850BD03-563E-4535-B92C-AFC307AB9F00}.exe
Size 197KB
SHA256 5cea3731a8d4afbab0976a96bb6facd8ad04d452e062439ef7369df6ea3ecefa
MD5 3c8c4a0902b1d91b601512a8f9131eb8
SHA1 1757b390f04e0d82b619d56baa483062b169ea56
SHA512 69157df762031ccfa4ab8914c539d8b0e4d4c2bdb4558d07e22d427fd44063f84a649a98f3de78f2225c3c72bb8842145cf6840c834177e61c9b73a24280119e
SSDEEP 3072:jEGh0ojl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGRlEeKcAEca
TLSH
T12A14B32527E54626F0F39B3588B08092AE37BF927A75DD1D21C8414D4A33B81DEA5F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe

Path C:\Windows\{FBB9DE66-5EFB-42f2-AD71-164231B152A5}.exe
Size 197KB
SHA256 4a603a661171199e917eb37eb61f05cf4c44db87723c7f993d06b38290192c56
MD5 c762b94da0cd5a9443f265ad987454b3
SHA1 fd7893f1d1d073442d66a660608ac5bb40c383e0
SHA512 ddcf48ce0954331dc969f5f54591c3f58cd4adc9e42f72786fb379583d4f663230e0e9a96712bef34cbfed58ddc637245ff768fe28e0261145e639db0b213e77
SSDEEP 3072:jEGh0oWl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMQ:jEGElEeKcAEca
TLSH
T15214B32527E54626F0F39B3588B08092AE37BF927A75DD1D21C8414D4A33B81DEA5F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads