Overview

overview

10

Static

static

70fa0e970a...in.exe

windows7_x64

10

70fa0e970a...in.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    23-12-2021 21:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d.bin.exe

  • Size

    51KB

  • MD5

    82f5dbbe1726bb9005072690b201aaac

  • SHA1

    7aef263a300c999b2a3d7d459308db6fb1906790

  • SHA256

    70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d

  • SHA512

    3cf95d7960fc2385041c1f51efe2180c1576ba191cd2699d36161d6740ffcb316f5db08d014404da426018341c0c60e14e22e1cb9bfed6d540ce657aaba85dcb

Score
10/10
globeimposterransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���42 79 55 6C 9E C3 4A 74 B7 AA C5 56 34 15 48 44 82 2D 55 EB A0 DF 6B 63 6D 5E 9A 73 A2 CF 52 57 94 7B 12 37 B8 4B C6 42 AC 2C F4 26 85 DA 0A A1 B7 75 20 DC 69 07 26 11 7D C4 F3 59 BE 7C B6 EB 27 70 14 EE 0F 5F 7D 68 3D DD 68 38 18 AD BA B4 54 E0 86 C8 1C 63 C3 ED 8D C1 8C C9 F2 22 8A 4F D9 10 D9 76 94 9D 46 86 B6 92 80 52 3C 3B B3 ED 68 89 61 1E 75 F1 43 34 58 BC 5F 4D A5 97 76 5C F7 81 07 E7 7A 3C B0 7E A7 8F A8 33 45 FC 47 92 F8 9B FF 36 09 4D C3 B8 0D 7B 7C C0 BC CE 92 5C CF D8 DB DE 4D B6 07 75 CD 85 75 6D 09 94 47 B6 BF A7 8A 76 12 13 C1 96 57 F6 47 C5 8A 49 C8 4E 73 79 58 88 EC B5 C7 FF 0E 37 2A F2 8B CA FF 95 CC 80 73 5E 62 54 66 BE 08 DD C4 30 17 8F B6 E1 01 83 85 D2 E6 B2 C5 39 05 35 F8 3F 15 01 C2 4E 12 50 01 82 80 10 51 DB 67 40 CA 7B C2 AC 5C 9F
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 28 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\70fa0e970a0c29da67b5f1468996eecf7116256c2b7212fb6667b0fb92ad839d.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:2836

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads