b017b2713cc3de62d13489f154f52b20186b71bfb7a6fc0abd96e4b146ca57ec

Analysis

user interaction
yes
max time kernel
899s
max time network
489s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Gladius_launcher.exe
Size 23.5MB
Sample260721-src2lsyfrc
SHA256 b017b2713cc3de62d13489f154f52b20186b71bfb7a6fc0abd96e4b146ca57ec
MD5 f105fc5dcf93c3c5e26ef7af8fbc2589
SHA1 5cfca0d7962e3e74c89805c719a9f2424a2fc3cf
SHA512 2b51cfa85d2813d5b0786fd74d23f9722f31461ec6270d6a7f28c2ee4ba66e4ddabba33892ad557b7360c75f5d7f9824185143b2daa7ae3730952e230a97641a
SSDEEP 393216:TLxAeQhES5hbd7AcHeI2rhtg2VZm8nkc1tr:T9AUSbhChT53mO
TLSH
T1B0478D47F49215E8C1AEE1308276A673BA717C9917246BE70B90F7342F36BD06EB6710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5020	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2844	Gladius_launcher.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 5020	2844	Gladius_launcher.exe	90

C:\Users\Admin\AppData\Local\Temp\Gladius_launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Gladius_launcher.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\reg.exe
  reg query HKCU\Software\Valve\Steam /v SteamPath
  2⤵
  - Modifies registry key
  PID:5020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2844-1-0x00007FF743860000-0x00007FF747220000-memory.dmp

Download