Overview

overview

10

Static

static

75e6ef6691...ac.exe

windows7_x64

10

75e6ef6691...ac.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    170s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    11-02-2022 06:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac.exe

  • Size

    52KB

  • MD5

    6a1eb94548ad075353d7e55826ad15a4

  • SHA1

    7719bc9194ddbfb1a496e8a15827592a5e371a14

  • SHA256

    75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac

  • SHA512

    37da482e3c71ee824c10f05d4d25ad6120e99dbf614c311c1743c108b5cce61da376709938fc1fe0cfed726568e6d071b64ffec5c22247a66dda170a4fcda9f2

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\instructions.html

Ransom Note
-----BEGIN PERSONAL IDENTIFIER----- �����������B5 F8 BD F8 27 39 16 2A 9C 24 31 E8 11 E7 95 4B 0D FC 54 45 D7 53 BD E4 5D E0 87 44 6D FC 17 4D 75 58 1A 04 BA 96 27 E7 37 D6 DC DE 8E B6 E4 B2 0D 8C 21 1B B1 52 05 E1 80 FC 8C E9 8C 30 76 92 9D 09 67 A0 C4 B5 24 DE 3E DB 0A FA A3 AA 26 90 FA C8 35 4E 47 53 05 18 41 64 FB 74 77 6D 31 1B 28 03 92 05 42 A1 C6 19 FE 2A B4 39 33 17 99 83 04 BD 06 ED 52 A8 B5 BC AF 2C C3 BA 2F 0A 3C 50 F4 38 0B 38 4A E6 F3 25 F4 4F D5 BF D3 44 C2 6F 5C F0 30 66 3B 7C 6A 7D 10 47 EB 9B 9D 80 FE 85 47 EF AC 87 5E FB 0C C8 F0 94 55 22 DC EB 43 BC 18 08 F3 C5 CA A9 E7 A3 BB 9D 99 6A 2B AE 3C 28 F7 A1 D5 29 D8 20 27 55 7B 4E 5B 9E D0 4F 38 1F 38 30 C5 FC BD CC 75 08 A6 13 57 A6 D5 6F 9A D8 6C 49 44 3E 09 7D EF 5C 6F B0 EB 10 03 C6 6F 57 69 07 80 FC CE 95 55 0B 7D FB 0B A9 98 D7 6A D0 -----END PERSONAL IDENTIFIER----- All your files have been encrypted due to a security problem with your PC. Now you should send us email with your personal identifier. This email will be as confirmation you are ready to pay for decryption key. You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: [email protected] Free decryption as guarantee! Before paying you can send us up to 3 files for free decryption. Files should not contain valuable information (databases, backups, large excel sheets, etc.). __________________________________________________________________________________________________ | | | How to obtain Bitcoins? | | | | * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click | | 'Buy bitcoins', and select the seller by payment method and price: | | https://localbitcoins.com/buy_bitcoins | | * Also you can find other places to buy Bitcoins and beginners guide here: | | http://www.coindesk.com/information/how-can-i-buy-bitcoins | | | |__________________________________________________________________________________________________| __________________________________________________________________________________________________ | | | Attention! | | | | * Do not rename encrypted files. | | * Do not try to decrypt your data using third party software, it may cause permanent data loss. | | * Do not try decryption of your files with the help of third parties. You can become a victim | | of a scam. | |__________________________________________________________________________________________________| ��������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac.exe
    "C:\Users\Admin\AppData\Local\Temp\75e6ef66914b9e180f649e42055de192163266c84072562a74eddda03437f4ac.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:1668

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1668-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

    Filesize

    8KB

    Download