Analysis
-
max time kernel
208s -
max time network
236s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 12:52
Static task
static1
Behavioral task
behavioral1
Sample
7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe
Resource
win7-20221111-en
General
-
Target
7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe
-
Size
247KB
-
MD5
a3d1897a5a519267b7f123eef9de0947
-
SHA1
797c9c1c18465749f1436119edbd5997efe5e301
-
SHA256
7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d
-
SHA512
b890128b11a3ba459af3b3eaa6dee57d590b8ce4cdf188383d04b3c25d097f7e43d248d38f9b9e1a7d7bc181741e9da2ca64a90ea47283a47fac11ad10d183c9
-
SSDEEP
6144:Bz+92mhAMJ/cPl3i8/5ctbOkN4s2Ks1JShvZsB6GgZpQo5HP8sb:BK2mhAMJ/cPlJWtqkv2kBZvGmpZvtb
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3216 gladiator.exe 3356 gladiatormgr.exe -
resource yara_rule behavioral2/memory/3356-141-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe -
Loads dropped DLL 1 IoCs
pid Process 3356 gladiatormgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 5056 3356 WerFault.exe 84 -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3216 gladiator.exe 3216 gladiator.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1348 wrote to memory of 3216 1348 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 82 PID 1348 wrote to memory of 3216 1348 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 82 PID 1348 wrote to memory of 3216 1348 7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe 82 PID 3216 wrote to memory of 3356 3216 gladiator.exe 84 PID 3216 wrote to memory of 3356 3216 gladiator.exe 84 PID 3216 wrote to memory of 3356 3216 gladiator.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe"C:\Users\Admin\AppData\Local\Temp\7953e42f63dc02aa5e9af2565ad8b42db651c10e9b565c000f1f6df5ce18bc3d.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiator.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiator.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiatormgr.exeC:\Users\Admin\AppData\Local\Temp\RarSFX0\gladiatormgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 5884⤵
- Program crash
PID:5056
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3356 -ip 33561⤵PID:4272
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD5e6f26494bbcfd64b8a344d3ef4fc9852
SHA1899998d47dcf58cfdf2993a38cf248fc8974b296
SHA2565788b5a23b5cde063805ad7974d35f7c22d34d28828eeeb5cacafd681e71f67f
SHA51258c0310dc2efb5ea0d436159d0884d9e7e8bad4f20c78f6e0e82c33913dc91d19b000cbcc6293af8e0f5ee8ff1edb3eeaedbd92eb64d552b76dd4c77faa52559
-
Filesize
220KB
MD5e6f26494bbcfd64b8a344d3ef4fc9852
SHA1899998d47dcf58cfdf2993a38cf248fc8974b296
SHA2565788b5a23b5cde063805ad7974d35f7c22d34d28828eeeb5cacafd681e71f67f
SHA51258c0310dc2efb5ea0d436159d0884d9e7e8bad4f20c78f6e0e82c33913dc91d19b000cbcc6293af8e0f5ee8ff1edb3eeaedbd92eb64d552b76dd4c77faa52559
-
Filesize
3KB
MD598849d0de2f28b65ae07fe8b128286ab
SHA1ba90d19afe009511265bb687eabf72717ece35eb
SHA256d3bdbf7e32f9e6c3d4669f07df4a401582742ba9a4f0d3fb0592539408869cd6
SHA5121fb6a20004736523ec99468944580cd6285b95a3080f8cf373082d9fb7f7c7cbf06c15ed00bb7e0aacafae5d0335ec159507f37d23de8c9ea89c14e82cba4231
-
Filesize
106KB
MD5fe36fb1073e6f8fa14d7250501a29aaf
SHA16c7e01278362797dabcff3e666b68227cb9af10f
SHA256f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
SHA5128584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f
-
Filesize
106KB
MD5fe36fb1073e6f8fa14d7250501a29aaf
SHA16c7e01278362797dabcff3e666b68227cb9af10f
SHA256f34e5af97ccb3574f7d5343246138daf979bfd1f9c37590e9a41f6420ddb3bb6
SHA5128584c008c5780352f634c37b7f46543a26280b57577b675f6e72185bfc1d95f771d210d799d704eceaba509ebfd2796fb43829495d5b2a568c741ad2d44f882f
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219