Overview

overview

10

Static

static

star.exe

windows7_x64

10

star.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    11-06-2022 17:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    star.exe

  • Size

    360KB

  • MD5

    2f121145ea11b36f9ade0cb8f319e40a

  • SHA1

    d68049989ce98f71f6a562e439f6b6f0a165f003

  • SHA256

    59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486

  • SHA512

    9211a74cfa23c70c6ace8bd168ecbe1bb4a06d2e03b5adff5546115137b6ce849d3e41337581123d48e5082319f507d8f2d274621317fada182530e4a0abb6c7

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read-me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���05 89 AB 6E AA 5A 8F 2E E4 43 B7 B8 3A 60 6E 09 74 3F A2 AF DA 24 B0 5C 98 3C 25 C6 0C 59 D7 3D B2 74 A5 A6 A9 8D 33 93 D7 D1 A8 30 51 D9 63 3A 0E B9 F9 AA 30 8C 8D 43 19 6E A5 9B 01 81 31 B9 72 3F D4 24 10 74 64 0C CC 09 22 0A 86 48 FB F7 FA C6 58 04 CB 69 B0 C5 73 BA 02 3A 95 C0 67 76 BE 6C 97 63 90 80 F0 A3 7D AE 49 42 05 E4 0D F4 0C 47 0F C5 1C B4 17 87 0D 5E 1C 84 92 3E D6 7A 12 13 6F 24 01 4D C0 00 7F 80 BC EF ED CC 32 E9 28 FE 8D 5C 88 A9 56 52 47 5E BC 59 AB 35 AD 45 63 0C 2B 9C E8 F4 34 28 EB FB 40 9F 81 73 D2 FC 99 0A 03 98 42 0D 24 A0 A2 82 F8 2E BB 42 79 D8 32 94 07 72 78 8B AC 87 C8 FB 2A A1 06 0F EE 80 26 40 52 3F 3C C2 CA 82 A5 E7 4A DE F2 7B 98 B4 95 2A B3 FD 03 70 A6 5C ED 24 9A 92 79 AC 0F B9 F5 3F BD 08 42 BE 72 69 7A DC E6 04 AD 02 11 33
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 11 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\star.exe
    "C:\Users\Admin\AppData\Local\Temp\star.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jVYbanglCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1F5F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:116
    • C:\Users\Admin\AppData\Local\Temp\star.exe
      "{path}"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:4956

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1F5F.tmp
    Filesize

    1KB

    MD5

    4fc8eef9be6e571df6803b42f3f3f21d

    SHA1

    20011bfa76c71a014cb48c1bc886d704d146ed5d

    SHA256

    dd2db6e98213001cef2e75787ef0650cf43a3fee98c530353b4adb0bc410c02b

    SHA512

    8fd630c9ff98f1ac0b7a01ea70fbd5dc8f470adab385cbfc4b5bfbede62904f6f685ce2d00eebd055ab14e8fe431bf96287940562a70638a17d4431474398dba

    Download Submit

  • C:\Users\Admin\AppData\Roaming\jVYbanglCI.exe
    Filesize

    360KB

    MD5

    ba9140e388ed6520961a142169bb4697

    SHA1

    0d09ecd9937e31ebd6308fa8378d3113f7ed5cd2

    SHA256

    a1232a02afaf8b97fece06840e62337438645a9111a812c5742ace4f87bf8a87

    SHA512

    7c1c06bed539b56a5b9853c949601ad203e253eea2e7c08c2e30e5af1b2280f1bc62f903294645eebc83e332e1c39609c7caa7f2e8a4fdb5e81c5bcd7fa0ee1f

    Download Submit

  • memory/3232-133-0x00000000052C0000-0x0000000005352000-memory.dmp

    Filesize

    584KB

    Download

  • memory/3232-134-0x0000000005160000-0x000000000516A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3232-135-0x0000000005450000-0x00000000054A6000-memory.dmp

    Filesize

    344KB

    Download

  • memory/3232-130-0x00000000008B0000-0x0000000000910000-memory.dmp

    Filesize

    384KB

    Download

  • memory/3232-132-0x00000000057D0000-0x0000000005D74000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3232-131-0x0000000005180000-0x000000000521C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4956-139-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4956-141-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4956-142-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download