Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-06-2022 16:21
General
-
Target
star.exe
-
Size
360KB
-
MD5
2f121145ea11b36f9ade0cb8f319e40a
-
SHA1
d68049989ce98f71f6a562e439f6b6f0a165f003
-
SHA256
59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486
-
SHA512
9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7
Malware Config
Extracted
C:\read-me.txt
globeimposter
http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV
http://helpqvrg3cc5mvb3.onion/
Signatures
-
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops desktop.ini file(s) 26 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\star.exe"C:\Users\Admin\AppData\Local\Temp\star.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jVYbanglCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp755F.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\star.exe"{path}"2⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD527cb4ca940005c867da111b7fc422907
SHA1bee062cdbafd01a56586c42da8b8974ef05077b0
SHA256ef8edea78648042891efe5100ec476a326efe4202bcd6d8e0c2c20cac7ac7b47
SHA512b20a747da044d45129c177d4d6b46560e11395d7d265de7674c31e100df9009db659a64b689000270cfc734c499ac3b4fc2d2ae07c72682f10742e735abf1c5e
-
Filesize
360KB
MD550f5b3f99a60e89c482689212e6c84c7
SHA1da8559943ff158cedc14ae639b1b1f767afbe536
SHA256bcfbc45332b2105520ad1d6a0a7140963f5e04cac7726f10b6e4f12547d9f4b9
SHA5127e2e7e3d20bc6e82efdd8b8b658845ae3b4eb058e24e50f3628424eb61d8cd26bf4ae76110632f453515ebd8af03e9144d8a7d4c027d36e0e17a3205d162d09f
-
Filesize
13.1MB
-
Filesize
8KB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.6MB
-
Filesize
13.1MB
-
Filesize
1008KB
-
Filesize
7.2MB
-
Filesize
40KB
-
Filesize
804KB
-
Filesize
19.6MB
-
Filesize
10.1MB
-
Filesize
1.8MB
-
Filesize
1.6MB
-
Filesize
7.9MB
-
Filesize
72KB
-
Filesize
10.1MB
-
Filesize
408KB
-
Filesize
19.6MB
-
Filesize
13.1MB
-
Filesize
1.6MB
-
Filesize
1.8MB
-
Filesize
10.1MB
-
Filesize
19.6MB
-
Filesize
56KB
-
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-