stormser | 52464a6bb49cc8dc8d8cd8b84d7375e63e93fe4a9ba6df64a3d500cfc5984724

General

Target
2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe
Size 216KB
Sample261104-2nlc9avyc1
SHA256 52464a6bb49cc8dc8d8cd8b84d7375e63e93fe4a9ba6df64a3d500cfc5984724
MD5 409a4bc5ceecbf57cbf2abc0e045def9
SHA1 fc28178154a4c968125be3962f062c33039ac806
SHA512 62bd357a0c5f2596eef3b829273cd328e34f123c18822d57613ed39bbf1d2baf8de01a531908689fd9e31b5c8d41d02ad8d5f69f2d5f2ecadcf1370e041d63d8
SSDEEP 3072:jEGh0oxl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGXlEeKcAEcGy
TLSH
T10024A3352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024458-2.dat	family_stormser
behavioral1/files/0x0008000000024449-5.dat	family_stormser

Custom signature

Auto-generated rule 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024458-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000024449-5.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}	2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}\stubpath = "C:\\Windows\\{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe"	2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B057EB18-0D64-4707-930F-EF6BC4C25BC0}	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B057EB18-0D64-4707-930F-EF6BC4C25BC0}\stubpath = "C:\\Windows\\{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe"	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe

Executes dropped EXE 2 IoCs

pid	Process
1712	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe
3368	{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe
File created	C:\Windows\{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe	2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1152	cmd.exe
2292	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2624	2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	1712	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 1712	2624	2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe	91
PID 2624 wrote to memory of 1152	2624	2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe	92
PID 1712 wrote to memory of 3368	1712	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe	93
PID 1712 wrote to memory of 2292	1712	{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_409a4bc5ceecbf57cbf2abc0e045def9_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe
  C:\Windows\{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe
    C:\Windows\{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{3667D~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe

Path C:\Windows\{3667D346-AF2C-4e3b-AFCE-C9FE083659C0}.exe
Size 216KB
SHA256 6694ed055770c096bc275708fb1f5ee76a19addd9eee858a5c82c0f80bdd2c1c
MD5 28e3a6068ae3236d4cc2e025a14b7c26
SHA1 47d94e7d69a6f789d754fed5ca05dadd0a002760
SHA512 a4cb372582fdbcc6a6a5f8598be67a3aff7e3daefaa2335d608200ea59acdd934ed4f78afd533d1dfc1379783840ca7dcdb2e0796723f7a84669957ac8475fd2
SSDEEP 3072:jEGh0obl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGJlEeKcAEcGy
TLSH
T17F2493352BE60626F0F39B7599B18492AE37BE923935CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe

Path C:\Windows\{B057EB18-0D64-4707-930F-EF6BC4C25BC0}.exe
Size 216KB
SHA256 9e31e74fe092732967a8508d90ef18db09f0dc94e5adeb08cf3bd6df15559dd2
MD5 1eacbe0005133df82f43083e97397da4
SHA1 2fd9c0d9f6599bd1fe7c59109ec72482b440aa5f
SHA512 539f96d5bbbe94aa013798da0e37751f4697639ba51d88bcce12143394cda35b46ed01083a143ca7910ff9ed001547689664bdfdbf0ed3b687c36109ee3b6191
SSDEEP 3072:jEGh0opl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGHlEeKcAEcGy
TLSH
T1712493352BE50626F0F39B7599B18492AE37BE923A35CD0D11C5024D4E33B41DEA6F2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads