Analysis
-
max time kernel
131s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe
Resource
win7-20221111-en
General
-
Target
7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe
-
Size
247KB
-
MD5
a3d1897a5a519267b7f123eef9de0947
-
SHA1
797c9c1c18465749f1436119edbd5997efe5e301
-
SHA256
7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d
-
SHA512
b890128b11a3ba459af3b3eaa6dee57d590b8ce4cdf188383d04b3c25d097f7e43d248d38f9b9e1a7d7bc181741e9da2ca64a90ea47283a47fac11ad10d183c9
-
SSDEEP
6144:Bz+92mhAMJ/cPl3i8/5ctbOkN4s2Ks1JShvZsB6GgZpQo5HP8sb:BK2mhAMJ/cPlJWtqkv2kBZvGmpZvtb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1116 gladiator.exe 524 gladiatormgr.exe -
resource yara_rule behavioral1/memory/524-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-77-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Loads dropped DLL 8 IoCs
pid Process 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 1116 gladiator.exe 1116 gladiator.exe 524 gladiatormgr.exe 524 gladiatormgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 664 524 WerFault.exe 29 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1116 gladiator.exe 1116 gladiator.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 944 wrote to memory of 1116 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 28 PID 944 wrote to memory of 1116 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 28 PID 944 wrote to memory of 1116 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 28 PID 944 wrote to memory of 1116 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 28 PID 944 wrote to memory of 1116 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 28 PID 944 wrote to memory of 1116 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 28 PID 944 wrote to memory of 1116 944 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 28 PID 1116 wrote to memory of 524 1116 gladiator.exe 29 PID 1116 wrote to memory of 524 1116 gladiator.exe 29 PID 1116 wrote to memory of 524 1116 gladiator.exe 29 PID 1116 wrote to memory of 524 1116 gladiator.exe 29 PID 1116 wrote to memory of 524 1116 gladiator.exe 29 PID 1116 wrote to memory of 524 1116 gladiator.exe 29 PID 1116 wrote to memory of 524 1116 gladiator.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe"C:\Users\Admin\AppData\Local\Temp\7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiator.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiator.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiatormgr.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiatormgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 2244⤵
- Program crash
PID:664
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5e6f26494bbcfd64b8a344d3ef4fc9852
SHA1899998d47dcf58cfdf2993a38cf248fc8974b296
SHA2565788b5a23b5cde063805ad7974d35f7c22d34d28828eeeb5cacafd681e71f67f
SHA51258c0310dc2efb5ea0d436159d0884d9e7e8bad4f20c78f6e0e82c33913dc91d19b000cbcc6293af8e0f5ee8ff1edb3eeaedbd92eb64d552b76dd4c77faa52559
-
Filesize
3KB
MD598849d0de2f28b65ae07fe8b128286ab
SHA1ba90d19afe009511265bb687eabf72717ece35eb
SHA256d3bdbf7e32f9e6c3d4669f07df4a401582742ba9a4f0d3fb0592539408869cd6
SHA5121fb6a20004736523ec99468944580cd6285b95a3080f8cf373082d9fb7f7c7cbf06c15ed00bb7e0aacafae5d0335ec159507f37d23de8c9ea89c14e82cba4231
-
Filesize
106KB
MD5fe36fb1073e6f8fa14d7250501a29aaf
SHA16c7e01278362797dabcff3e666b68227cb9af10f
SHA256f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
SHA5128584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f
-
Filesize
220KB
MD5e6f26494bbcfd64b8a344d3ef4fc9852
SHA1899998d47dcf58cfdf2993a38cf248fc8974b296
SHA2565788b5a23b5cde063805ad7974d35f7c22d34d28828eeeb5cacafd681e71f67f
SHA51258c0310dc2efb5ea0d436159d0884d9e7e8bad4f20c78f6e0e82c33913dc91d19b000cbcc6293af8e0f5ee8ff1edb3eeaedbd92eb64d552b76dd4c77faa52559
-
Filesize
220KB
MD5e6f26494bbcfd64b8a344d3ef4fc9852
SHA1899998d47dcf58cfdf2993a38cf248fc8974b296
SHA2565788b5a23b5cde063805ad7974d35f7c22d34d28828eeeb5cacafd681e71f67f
SHA51258c0310dc2efb5ea0d436159d0884d9e7e8bad4f20c78f6e0e82c33913dc91d19b000cbcc6293af8e0f5ee8ff1edb3eeaedbd92eb64d552b76dd4c77faa52559
-
Filesize
220KB
MD5e6f26494bbcfd64b8a344d3ef4fc9852
SHA1899998d47dcf58cfdf2993a38cf248fc8974b296
SHA2565788b5a23b5cde063805ad7974d35f7c22d34d28828eeeb5cacafd681e71f67f
SHA51258c0310dc2efb5ea0d436159d0884d9e7e8bad4f20c78f6e0e82c33913dc91d19b000cbcc6293af8e0f5ee8ff1edb3eeaedbd92eb64d552b76dd4c77faa52559
-
Filesize
220KB
MD5e6f26494bbcfd64b8a344d3ef4fc9852
SHA1899998d47dcf58cfdf2993a38cf248fc8974b296
SHA2565788b5a23b5cde063805ad7974d35f7c22d34d28828eeeb5cacafd681e71f67f
SHA51258c0310dc2efb5ea0d436159d0884d9e7e8bad4f20c78f6e0e82c33913dc91d19b000cbcc6293af8e0f5ee8ff1edb3eeaedbd92eb64d552b76dd4c77faa52559
-
Filesize
106KB
MD5fe36fb1073e6f8fa14d7250501a29aaf
SHA16c7e01278362797dabcff3e666b68227cb9af10f
SHA256f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
SHA5128584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f
-
Filesize
106KB
MD5fe36fb1073e6f8fa14d7250501a29aaf
SHA16c7e01278362797dabcff3e666b68227cb9af10f
SHA256f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
SHA5128584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f
-
Filesize
1.2MB
MD5d124f55b9393c976963407dff51ffa79
SHA12c7bbedd79791bfb866898c85b504186db610b5d
SHA256ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef
SHA512278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06
-
Filesize
1.1MB
MD59b98d47916ead4f69ef51b56b0c2323c
SHA1290a80b4ded0efc0fd00816f373fcea81a521330
SHA25696e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b
SHA51268b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94