Overview

overview

10

Static

static

39f5b60188...in.exe

windows7_x64

10

39f5b60188...in.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    23-12-2021 23:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe

  • Size

    51KB

  • MD5

    e4e439fc5ade188ba2c69367ba6731b6

  • SHA1

    d4b3b403b95d50a2feefa046441600e488b941f4

  • SHA256

    39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde

  • SHA512

    068d7ba1563bf528520a5106a99245896578ac88b0a3263383cdae8657403deba659c06f429dd83710d1f5afa324a49254dd68911382db71810f98a498e901e7

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���46 FA ED 64 47 69 9E B2 3A AA 94 1C D7 65 E2 17 E3 03 32 5F C1 D5 0E 29 82 0D B9 0F C3 D8 3E 72 60 D2 D1 18 CA 7F 03 6C C3 9D 2C 36 52 89 86 13 3A 9B 14 3D 27 BB DC 4C E4 FC 95 57 48 1B 33 DB 30 D1 B1 3C E8 FF 27 6E ED D5 E2 5E F5 EC B6 7B 6C 25 34 05 E4 4F 20 79 1E 35 6F 7D 42 9B 7B C6 CE 2A A3 6D 8F E7 27 3A 76 EF 07 95 61 D8 54 9E 51 FF 2A DC 14 61 1F 7C 59 5B B9 5A 2A C2 FB 1C 50 68 24 F2 E6 39 39 FB 21 5F 50 19 88 0D B4 A1 14 D6 F6 5C 10 85 6F 13 90 CB 1B 3D F9 FF A3 2F 35 37 B3 2F 56 3B EF 9D 5A 9E 62 C2 27 34 2B F1 91 32 5A FB A4 2D 37 67 8E C4 D3 BB 0A 4C 48 55 6A AD F8 5F DE 41 A9 62 EC E2 4B EB 69 29 40 1F 3B 3A 4F 1A 8C 7B DC 11 7D 2D 5A B4 2C 9D 9D C0 A0 56 31 0F FB 04 5D C2 41 12 6A 1B A2 8F CE 08 38 35 D5 1C F1 00 D4 91 E2 2F A2 78 A6 9E FB D1
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 8 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 36 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\39f5b60188d49196e6c10271a084a755f9553190898438b15107cdb950a4bbde.bin.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:1656

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1656-54-0x0000000075431000-0x0000000075433000-memory.dmp

    Filesize

    8KB

    Download