Overview

overview

10

Static

static

star.exe

windows7_x64

10

star.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    10-05-2022 06:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    star.exe

  • Size

    360KB

  • MD5

    2f121145ea11b36f9ade0cb8f319e40a

  • SHA1

    d68049989ce98f71f6a562e439f6b6f0a165f003

  • SHA256

    59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

  • SHA512

    9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���7A 5B DD 61 81 91 81 95 62 B8 B3 76 71 6E F6 F4 59 BE 95 9C 2F F7 1B 5C F0 24 93 97 E3 AA D1 B1 A0 71 AC 95 72 CF 77 70 2B 4B 41 FE 0F E2 91 04 56 27 A6 14 0A E5 85 BE 79 32 FA C9 08 8B C2 0E AF AD 0C 91 D4 43 4F 8C 34 8E 55 4B 2F 8D 11 54 C1 9C F2 82 75 70 31 2F D5 6A 91 B0 28 6B 4B AD 02 CD 59 C1 40 5C 60 26 78 1A 89 D6 DB 6F EA E4 89 07 4B 49 CE 5D 20 89 17 85 E3 D2 87 8C 35 4A CC 8C F5 86 06 D4 8E D5 9F 82 FB 2E B1 83 F7 23 C1 03 1D 7E 74 7E 7B 8B 2F 01 4A DF 8A C7 3D FD 21 3E 88 84 1D A9 EF 7B 30 1D 49 C2 4F 41 C0 BA FA D0 3C 2B 49 52 CD 22 EA 8F 30 05 7B C5 D0 E7 2E 8D C8 51 04 18 68 70 A6 AC 94 39 33 31 E3 24 1A C9 49 3B 67 6E A7 F2 07 BF A2 20 20 8A 47 DC F9 A5 AD C3 71 61 4E 4C 48 BF D8 FD 1D C7 C0 63 97 F6 52 E8 02 E0 CC 37 86 D3 C3 4B 1E 7E 59 23
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\star.exe
    "C:\Users\Admin\AppData\Local\Temp\star.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jVYbanglCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7975.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:960
    • C:\Users\Admin\AppData\Local\Temp\star.exe
      "{path}"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:1196

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp7975.tmp
    Filesize

    1KB

    MD5

    bb910ae88dc840ba6e45389ffe6c6196

    SHA1

    640c0e3a1e918c12255a51f16ab6bb5ece1e85a6

    SHA256

    68be26cec28d3e64f867678c40994352ad27b2e92c0c7db9fdaf068b290541ee

    SHA512

    e6b95310c5b3ad7553e9992ade23934e4ed128959702ca39b9c27cf5408517e1b2ca336a2823323aaf841ca04a793030cbd60af6d40ec15f728981c9bf840fb1

    Download Submit

  • C:\Users\Admin\AppData\Roaming\jVYbanglCI.exe
    Filesize

    360KB

    MD5

    288358daa673ba0dea60a03d56a37e7f

    SHA1

    81cdfb9c06fcb6b72a3241453d00f3a46d02b14d

    SHA256

    c09562db891c2110734610e0db85695493e92fc7aac8c9a6211a17d812fbfadb

    SHA512

    0c588cbd0e11f83ddeb208a3b205cbf98004218672d7134c046ca926e4b0ed4253c4a36990b0414c930e3ac48bfaf1bfd9459f5fd604fecdb9dd557a9fcd0599

    Download Submit

  • memory/960-59-0x0000000000000000-mapping.dmp

    Download

  • memory/1196-64-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1196-61-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1196-62-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1196-65-0x0000000000409F20-mapping.dmp

    Download

  • memory/1196-68-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1196-69-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1652-58-0x0000000000AF0000-0x0000000000B02000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1652-57-0x0000000004480000-0x00000000044E6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1652-56-0x00000000004C0000-0x00000000004CA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1652-54-0x0000000000B80000-0x0000000000BE0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1652-55-0x00000000752B1000-0x00000000752B3000-memory.dmp

    Filesize

    8KB

    Download