Overview

overview

10

Static

static

star.exe

windows7_x64

10

star.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    22-05-2022 05:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    star.exe

  • Size

    360KB

  • MD5

    2f121145ea11b36f9ade0cb8f319e40a

  • SHA1

    d68049989ce98f71f6a562e439f6b6f0a165f003

  • SHA256

    59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

  • SHA512

    9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���57 55 F7 6E 74 D3 8A 73 C4 AA 3E 16 95 65 1F CD 7E 48 83 08 9A 60 E6 21 87 2C 6E FC B0 26 E4 D5 8B 74 E9 67 54 58 1D 76 5F 99 73 F9 FF 04 51 30 5F BC 21 29 BC 23 D6 9B 0F 42 E6 5D 8D B7 17 53 80 6B 02 37 6F 32 8E 59 42 E7 47 A5 6D 47 8B D2 EB 8A 04 A8 49 93 30 02 02 E0 43 44 2F 94 41 4F EA 46 4C CE 59 10 7A B9 F1 44 AC EC B8 C9 51 21 7B 3E 44 55 E7 00 B5 CB CE 30 5B F8 CC 62 2F CA BE 18 53 BA D5 CF E7 C0 12 7D 61 88 8A B5 BA CF 8E 24 08 E4 CF BC 28 1F 75 58 F1 A3 11 51 E4 4F 3C E5 13 C5 FC EB 3D 8B CF C6 85 A0 BF ED 4A 8A C8 EF 02 C5 C0 9F 42 44 83 BA 66 11 7E EF 7A 0D A1 F2 8E FC 7E 1E 4C E3 49 26 FF 5A F0 30 FD E6 D7 E2 C9 A0 DA 88 D4 79 EA EF 5F 32 EC 98 89 A3 82 3B 1E 33 18 59 FB 54 5B EB F0 01 D6 73 1E 5C 94 14 DB 97 FB 9D 63 05 07 08 CF D0 B3 03 CF 9B
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\star.exe
    "C:\Users\Admin\AppData\Local\Temp\star.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4824
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jVYbanglCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp62A2.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1996
    • C:\Users\Admin\AppData\Local\Temp\star.exe
      "{path}"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:1708

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp62A2.tmp
    Filesize

    1KB

    MD5

    243998c586e102d5706d22e1ccdb5781

    SHA1

    a8326b85c94e9f68b6a92c45551933fb5d5fdb52

    SHA256

    4bcf513eb854417da91582ebb18b08b740bddb3fb6973f3693cbcf65c76b4331

    SHA512

    720376589d9dcd21c138f4725b66a8b604b3d6691c61c3c980cc0cead4184da328906e669497276caee719363cdf09c19d11c4a4729983a7a632c817c0ab642d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\jVYbanglCI.exe
    Filesize

    360KB

    MD5

    ada1c1e7c9dc488b3c5360de1853e46f

    SHA1

    e6416c7d4fa8b2a2b018f811d9e5dbad2913b4b3

    SHA256

    dbc4cf91610e37fc32110e83828eb74ae6b6326be76a9dcc0543bbfba41793c5

    SHA512

    bfb432eca280e9f0bff5cd727c798af16684d93429945e09657de4cef5ae93c35a552be1c7ab3ca0ea6073856054417334a913248acd9c5bfdc795e56901b70a

    Download Submit

  • memory/1708-142-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1708-141-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1708-139-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4824-130-0x0000000000700000-0x0000000000760000-memory.dmp

    Filesize

    384KB

    Download

  • memory/4824-135-0x00000000053E0000-0x0000000005436000-memory.dmp

    Filesize

    344KB

    Download

  • memory/4824-134-0x00000000051B0000-0x00000000051BA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4824-133-0x00000000051F0000-0x0000000005282000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4824-132-0x0000000005700000-0x0000000005CA4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4824-131-0x0000000005090000-0x000000000512C000-memory.dmp

    Filesize

    624KB

    Download