Overview

overview

10

Static

static

131ca56bb5...44.exe

windows7_x64

10

131ca56bb5...44.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-06-2022 13:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe

  • Size

    361KB

  • MD5

    3969f76be0d978d81cf587a7e8fab17a

  • SHA1

    2f69a78547ed0a7cb6869c237b50c6ed6c54cd77

  • SHA256

    131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044

  • SHA512

    cdbebe34b661f449f9696c3bb2a27297b0e23e8e0b012d6a809c8a4ca12138fe2592170ea15c79076e3f9d3620f292a4847c48594459e207732e74037c14b2fc

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������48 E4 A2 A8 16 47 F0 ED CC 19 FE F3 0B D3 1E F2 BE 63 69 7D 4F 1B AF 84 33 A7 F4 C1 7C 17 85 C6 E5 68 A6 33 E7 7E 0B 24 4A 2B EB CD 66 2B AF C4 8E D7 AB 53 76 E0 E0 B4 40 37 E7 D3 C7 9F 9A 04 4C 16 CF 90 46 E0 3F AA 27 80 04 45 E6 EE 97 63 F7 1E 3D E7 CC 61 98 F0 18 43 59 5D C1 63 2C 91 3D 0B AD D8 22 28 BB 14 FF 64 C5 D6 E8 CB 95 20 BA F9 69 95 CA 92 1F 6A 2F 58 21 84 FC 39 07 B7 63 9E 62 05 BF 38 1C CE 8F 5B 0E C6 EE A1 E5 BF BB AE BA 5D 57 4C 2F FC 6A D9 D3 4C E4 64 C9 CF 5D B1 C4 C7 F6 07 C8 FA 7B 7E F2 2B 03 73 D4 BE 7C D6 48 44 B1 9D CE D5 71 22 30 72 BC 43 A0 18 42 54 06 75 14 52 D2 D7 30 48 3E 07 27 84 FF C9 7E 2D 89 68 B1 0D E9 3F 8B 4D E5 4E CD 2E 44 FD 2F 3D 80 37 2C 87 04 20 9E E8 A8 6E 4B 22 4C BC 3E 42 F6 96 82 F1 CF D6 7C A4 26 D7 E2 C9 6C 92 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe
    "C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe
      "C:\Users\Admin\AppData\Local\Temp\131ca56bb58b9fc68b7cc595e534208625bb9230d7d5b42e747ca4fa1945e044.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:116

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/116-131-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download