Overview

overview

10

Static

static

965312dce8...9a.exe

windows7_x64

10

965312dce8...9a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    130s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    30-03-2022 02:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe

  • Size

    2.9MB

  • MD5

    d4ddfd6ce54841bddce22d8ca819363b

  • SHA1

    4148288be1d9250c29f5af83ef27b468787bcdbb

  • SHA256

    965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a

  • SHA512

    eafbc1c3d96b5720368b38e39237460ebd0a1c1d709336dc47c4af61e20c9d19b6dae437459aa4c86534754965f1fc66ba67cac132ba3072e4798e7f94085cc4

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 36 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe
    "C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 616
      2⤵
      • Program crash
      PID:1852
    • C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe
      "C:\Users\Admin\AppData\Local\Temp\965312dce88eabcf4089f8fa18642cf00d410e3b07c8647eb1f1775ddd8f529a.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:888

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/888-64-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/888-63-0x0000000075A51000-0x0000000075A53000-memory.dmp

    Filesize

    8KB

    Download

  • memory/888-60-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/888-59-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/888-57-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/888-56-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/1536-54-0x0000000001240000-0x0000000001526000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/1536-55-0x0000000000570000-0x00000000005C6000-memory.dmp

    Filesize

    344KB

    Download