globeimposter | 3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6

General

Target

3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
Size

93KB
MD5

917a7d83a1c22177d25292ed1aff1676
SHA1

5bc651d230da5ff2365ae0d9f067f62bb00d9983
SHA256

3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6
SHA512

1cb5c17aa313ee67b0a9e62166b9508fea597bfb7fde444eed09ca4e3782a21bf792f51cfa171ec836311b24558e81aa72e5ebf6ed6b05a50ba6a76756f40bae

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe"	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Searches\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe

C:\Users\Admin\AppData\Local\Temp\3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe
"C:\Users\Admin\AppData\Local\Temp\3f8d11e850d95fb6a650f13386abb6afb8d7f56bf8de8965891ab565907b70a6.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:1184