Overview

overview

10

Static

static

star.exe

windows7_x64

10

star.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-05-2022 22:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    star.exe

  • Size

    360KB

  • MD5

    2f121145ea11b36f9ade0cb8f319e40a

  • SHA1

    d68049989ce98f71f6a562e439f6b6f0a165f003

  • SHA256

    59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

  • SHA512

    9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���6A B7 C3 B8 18 5E D1 2A 41 32 4E 79 82 C5 18 B6 0C 14 18 EC 6C EA A7 C5 12 F8 51 BB 5B A6 C3 46 25 F7 AD D1 32 2C 92 F8 AC 5C 08 6C 82 DA F6 DA 1A B6 29 14 60 7F 3D 6D EB 8C F8 DC B4 83 8A F2 84 76 44 18 22 73 9C F2 A8 3A 97 1D 47 3A 9D 0A 21 EF 11 C5 A6 A8 68 4D 42 59 5A 53 D2 3A 6E 00 AA 32 FB 16 AF 8C 48 01 7E AD A2 35 5F 25 7F F1 05 2B CE 37 4E 12 80 A0 B8 43 0C 0F A0 5F 64 2F 15 3E 75 71 38 5B 6A 3D A8 E4 0D 43 AD A4 98 B9 4F D8 CA C5 72 18 AB 95 A4 FB 21 DE 65 3C DE 10 96 C4 89 35 06 2A 18 C6 FE BA A7 1C CC 5D AC 2B FB 46 F0 B4 30 84 CF C4 AD AC 5A A2 EE FB 9E 6C 54 95 7C 06 6D A0 B3 12 AC D5 AF D9 7B D6 E0 3E 88 3F BD 38 90 5B 4B 2E 78 32 F9 8F 70 CE 53 9E CB 41 46 3C 2D CF B1 EF 2A B7 91 94 E2 C1 DF 21 C0 84 94 FC E0 65 EF 75 D8 85 B4 32 DF EA 38 65
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\star.exe
    "C:\Users\Admin\AppData\Local\Temp\star.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jVYbanglCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA545.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1544
    • C:\Users\Admin\AppData\Local\Temp\star.exe
      "{path}"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:1492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA545.tmp
    Filesize

    1KB

    MD5

    efef11175efa67cf47fdfc5d674fc3ba

    SHA1

    84b712204ffb9f24ef7953707986d80ef57e4001

    SHA256

    52b0fa5fd3c4263bb136cec86f505c8127876fb65f4a3c9d0463d9bf7f05a707

    SHA512

    279dbdddaf5aeb2b37a33adb69a30d3f301699fa83162d943b5d548fb28d93037c195bb3b0506e90dc81a05bada14215cb3cb86d6077d153192d4bdc7d6d0c38

    Download Submit

  • C:\Users\Admin\AppData\Roaming\jVYbanglCI.exe
    Filesize

    360KB

    MD5

    73e4ce3f3c39af96288a67972f5c301a

    SHA1

    1953150d24db2dd4f7ae32d7657b48a4020cd718

    SHA256

    05a90cb4d4c1a61c821f206c5cf8c97fa9ab7393149da37ee2b7c47e59caf2e1

    SHA512

    f0e250d5cd532c96088508d4bc3a6499a79bc0ac464ba413afaa19985d3c3a835aef637dbbc1d29f0c730f31237efd12fce6ab60bcb9bdba478866e0d80932ad

    Download Submit

  • memory/1464-57-0x0000000005A70000-0x0000000005AD6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1464-54-0x0000000000840000-0x00000000008A0000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1464-58-0x0000000003FD0000-0x0000000003FE2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1464-56-0x0000000000590000-0x000000000059A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1464-55-0x0000000075381000-0x0000000075383000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1492-61-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1492-62-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1492-64-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1492-68-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1492-69-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download