stormser | c00e35cf426189c4eda3dabfd036c8ecc5bf369aa7eaa34e43113ed4fe6dcb13

General

Target
2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe
Size 204KB
Sample261111-3yrtfscw7l
SHA256 c00e35cf426189c4eda3dabfd036c8ecc5bf369aa7eaa34e43113ed4fe6dcb13
MD5 a5f39b5f964648731279fd896243afb3
SHA1 cf0760cc028423d7c7519a1610a8c3728ebaa1bc
SHA512 34220fee3400492791a997b20cc1cb82bb2fc9abfde98c6d543dfe911db38a00176a7d1a6ed2e8172d6b7610aabf2f943b2a36430e77cedc7bbb3f1059f3908f
SSDEEP 1536:1EGh0oHl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oHl1OPOe2MUVg3Ve+rXfMUy
TLSH
T1551419396FD394B2D0B3C2744AF18583FE23FD9235614E0E25D543458C62A62EDABE2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024463-2.dat	family_stormser
behavioral1/files/0x0008000000024454-6.dat	family_stormser
behavioral1/files/0x000800000002446b-10.dat	family_stormser
behavioral1/files/0x0009000000024454-14.dat	family_stormser

Custom signature

Auto-generated rule 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024463-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0008000000024454-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x000800000002446b-10.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral1/files/0x0009000000024454-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A684077-9C33-4001-A0D0-CF0B7D0E7769}	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1A684077-9C33-4001-A0D0-CF0B7D0E7769}\stubpath = "C:\\Windows\\{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe"	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A528A9F-BF60-42de-A0EB-5DC1172D5237}	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7A528A9F-BF60-42de-A0EB-5DC1172D5237}\stubpath = "C:\\Windows\\{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe"	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{053464CA-3C5E-4be3-9D37-79CC4D56AA21}	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{053464CA-3C5E-4be3-9D37-79CC4D56AA21}\stubpath = "C:\\Windows\\{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe"	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDD90E83-2630-42e0-9292-8F55646FEECA}	2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DDD90E83-2630-42e0-9292-8F55646FEECA}\stubpath = "C:\\Windows\\{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe"	2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe

Executes dropped EXE 4 IoCs

pid	Process
4384	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
2180	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
2560	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe
2920	{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe	2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe
File created	C:\Windows\{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
File created	C:\Windows\{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
File created	C:\Windows\{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1812	cmd.exe
768	cmd.exe
4140	cmd.exe
4532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1708	2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	4384	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
Token: SeIncBasePriorityPrivilege	2180	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
Token: SeIncBasePriorityPrivilege	2560	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 4384	1708	2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe	92
PID 1708 wrote to memory of 1812	1708	2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe	93
PID 4384 wrote to memory of 2180	4384	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe	94
PID 4384 wrote to memory of 768	4384	{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe	95
PID 2180 wrote to memory of 2560	2180	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe	98
PID 2180 wrote to memory of 4140	2180	{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe	99
PID 2560 wrote to memory of 2920	2560	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe	100
PID 2560 wrote to memory of 4532	2560	{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-10_a5f39b5f964648731279fd896243afb3_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
  C:\Windows\{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
    C:\Windows\{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe
      C:\Windows\{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\Windows\{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe
        
        C:\Windows\{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2920
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7A528~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4532
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{1A684~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{DDD90~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe

Path C:\Windows\{053464CA-3C5E-4be3-9D37-79CC4D56AA21}.exe
Size 204KB
SHA256 b9184509eb47fd843eca88ace712175c191520a95efe7ca837383ea387a42929
MD5 9a801125623b2c866e81c0ffe31e58dc
SHA1 5cc136f1220d5da9eb94b794065efa39451d110f
SHA512 969261f73937c4e531ea6de63426527f683fc0452cbd3a83fcfba986f0440c99748ac17cdbc5cef687303f025cefc08c8f99ab95ea6feeae7e9b1950294421b5
SSDEEP 1536:1EGh0o/l15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0o/l1OPOe2MUVg3Ve+rXfMUy
TLSH
T1F11419396FD394B2D0B3C2744AF18583FE23FD9235614E0E25D543458C62A62EDABE2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe

Path C:\Windows\{1A684077-9C33-4001-A0D0-CF0B7D0E7769}.exe
Size 204KB
SHA256 992ff90b8a02767058612fbbb9fc5cccb047219e473a5ab2525f59782630f9e7
MD5 bf5648f0d171c8072fa6b9dfdfcbac40
SHA1 8688ebb04447dce7099c1cd01a63b7c2fda0e99d
SHA512 4185d8d819f69371169a35ec3167463a9672c4708914d2dc89471abb0af33ea0db7a36f5cf5e188c6f3237690597f1b32ee5dc4e5704c415591b3480f4e4231c
SSDEEP 1536:1EGh0o+Ll15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oil1OPOe2MUVg3Ve+rXfMUy
TLSH
T1F81419396FD394B2D0B3C2744AF08583FE23FD9235614E0E25D543458C62A62EDABE2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe

Path C:\Windows\{7A528A9F-BF60-42de-A0EB-5DC1172D5237}.exe
Size 204KB
SHA256 cfc146410409988249a25245e7dab4b83131a7f123fa9f8e64713af4e4c5d834
MD5 3c6af9baca9fa85a00e0b27722889c0d
SHA1 30503e9c8185f35cba18e073694db35c8b4cd9ad
SHA512 a8cc233468a11ac80dae9d3b440bffa24e8d2c95d61d09b4e15ae5dc7e8f0fc72bcde49cf49f20345c31fe15e5bb0ea79f3853af7d587626647f86cf5dfa30ce
SSDEEP 1536:1EGh0oSl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oSl1OPOe2MUVg3Ve+rXfMUy
TLSH
T1811419396FD394B2D0B3C2744AF18583FE23FD9235614E0E25D543458C62A62EDABE2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe

Path C:\Windows\{DDD90E83-2630-42e0-9292-8F55646FEECA}.exe
Size 204KB
SHA256 36b569ca4ba73a257f9a16410e1420cd1d22850205a7a58e46ddd80d0afc5018
MD5 243759a8056cdc6bd81a37b9b90251c8
SHA1 b164028838f01bd174eef864fce396e2dfa9279d
SHA512 dfe004fb022e2072ad60b2d3d267ea529c43b2d95673b889c6427d740fe790312984bef66f515156b62aa912f164bdf630976dca7babf203a9ef1742c5c714a7
SSDEEP 1536:1EGh0oDl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oDl1OPOe2MUVg3Ve+rXfMUy
TLSH
T1571419396FD394B2D0B3C2744AF18583FE23FD9235614E0E25D543458C62A62EDABE2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads