Overview

overview

10

Static

static

01304bd638...1c.exe

windows7_x64

10

01304bd638...1c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294211s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    06-03-2022 03:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01304bd638ed3fb82645b1487c019b32ebf21d867920a8d58bba605d5d15d31c.exe

  • Size

    50KB

  • MD5

    339c00f5861c6381d0a66106f532bf0b

  • SHA1

    4e8f95b7170907c427652278ea8967b255651d14

  • SHA256

    01304bd638ed3fb82645b1487c019b32ebf21d867920a8d58bba605d5d15d31c

  • SHA512

    df30a9a428fd3d69b5ca0b97f2d736147efbe43326549a7427200a8a8bc835392ed43989b8e591e87034176195e538659b56fe7a86f3eb71fd8cfe8c4aa45338

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\WERE_MY _FILES.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ------------------------------------------------ create a ticket to any of these addresses yip.su/2QstD5 cutt.ly/0htT0he shorturl.at/GOY24 bit.ly/3399Ozf ------------------------------------------------ you can also attach a small cryptted file for a free test decrypt Additional communication method ------------------------------- 1. Download Tor browser - httpps://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://helpqvrg3cc5mvb3.onion/ -------------------------------- You ID ����������5F 0F 6A EC 42 26 A8 1D 13 97 54 C1 1A 51 C3 64 9B D1 18 FD 9A DE A7 8E D1 D1 78 E1 5E 55 17 D2 BB EF 82 60 41 EA 9B DB 73 D9 B8 22 AE 49 13 74 CF 77 8E 4D 9B D7 9F 81 C0 BE D5 95 70 ED 9B 55 53 CD 8B 27 78 B4 FE F1 B1 8A 33 4D 6C CA D6 F8 A7 C7 3E 5B F7 20 4C 67 74 DD 5C 25 E0 6E 16 94 A5 96 06 7C F6 C3 D3 4C C4 70 76 0B AB 7A F1 DE 7A 94 67 45 95 7A C7 F4 1F 3A 78 64 8D CA 8C 88 0C EA 8B 47 19 25 50 60 2E D0 5E 4D 61 D2 05 5C FF F2 73 91 62 5E F4 45 51 16 AB C3 6B D6 06 F0 8C A1 4E 82 4E D1 6A 7C 7A B2 59 E9 03 86 4B E8 05 D1 7B 3C C0 C2 89 A1 F6 59 E9 F9 7D B5 DE D2 D9 F0 33 99 25 79 48 81 07 86 48 BA 91 2C 90 4B 7E 82 9C FF 0B 24 66 AE FA 46 DE 6F C8 F3 EA 1B EF 41 18 4B FD 4B 12 31 C2 D9 5A 9E C1 58 83 1D 6A C5 30 42 BF D8 1C 7B A5 15 5B 92 44 18 DD 35 ��������������
URLs

httpps://www.torproject.org/

http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 36 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01304bd638ed3fb82645b1487c019b32ebf21d867920a8d58bba605d5d15d31c.exe
    "C:\Users\Admin\AppData\Local\Temp\01304bd638ed3fb82645b1487c019b32ebf21d867920a8d58bba605d5d15d31c.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:1924

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1924-54-0x00000000757C1000-0x00000000757C3000-memory.dmp

    Filesize

    8KB

    Download