Overview

overview

10

Static

static

1

18ef9d0649...1a.exe

windows7_x64

10

18ef9d0649...1a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-06-2022 15:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    18ef9d0649ea655ab0b8fea5e57ffb8a8493a0ac695863fb0290afe13d3bb01a.exe

  • Size

    187KB

  • MD5

    8f59ad7e91a0a875e8389931f8086196

  • SHA1

    d644611bf6edec70568993896f6e95c6f1a577dc

  • SHA256

    18ef9d0649ea655ab0b8fea5e57ffb8a8493a0ac695863fb0290afe13d3bb01a

  • SHA512

    67e459fcfa72fe71cd0387e7ee6267fbcd736d6f83461b08b6e6f284f8d1fb2cb2926bbb5879a7ff00fb468a3c05aa0fa4f09b64e9aecf1591cdefdcc4bb22ae

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18ef9d0649ea655ab0b8fea5e57ffb8a8493a0ac695863fb0290afe13d3bb01a.exe
    "C:\Users\Admin\AppData\Local\Temp\18ef9d0649ea655ab0b8fea5e57ffb8a8493a0ac695863fb0290afe13d3bb01a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\Users\Admin\AppData\Local\Temp\18ef9d0649ea655ab0b8fea5e57ffb8a8493a0ac695863fb0290afe13d3bb01a.exe
      "C:\Users\Admin\AppData\Local\Temp\18ef9d0649ea655ab0b8fea5e57ffb8a8493a0ac695863fb0290afe13d3bb01a.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1344

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jpr
    Filesize

    72KB

    MD5

    47f7c9d2e18821b488dda2a9a6119881

    SHA1

    42b23c77e7fe5dc05f83e664a0407ac111778ec3

    SHA256

    cb3129725d456e7c08db35168cd8f78ea5803cbcf82a031c5ebbbc59dfa030d6

    SHA512

    64fdd3e09a9f65a05e267429a089d3f2e78141539f0afec664630648bf8c4290b48d2fb30cb8386699996dbd0e59e62ed80a83f3b137834e0caa7ec3a61b0d65

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsy2B86.tmp\System.dll
    Filesize

    11KB

    MD5

    3f176d1ee13b0d7d6bd92e1c7a0b9bae

    SHA1

    fe582246792774c2c9dd15639ffa0aca90d6fd0b

    SHA256

    fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

    SHA512

    0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsy2B86.tmp\System.dll
    Filesize

    11KB

    MD5

    3f176d1ee13b0d7d6bd92e1c7a0b9bae

    SHA1

    fe582246792774c2c9dd15639ffa0aca90d6fd0b

    SHA256

    fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

    SHA512

    0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

    Download Submit

  • memory/1344-58-0x0000000000400000-0x000000000040E600-memory.dmp

    Filesize

    57KB

    Download

  • memory/1700-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

    Filesize

    8KB

    Download