globeimposter | 22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a

General

Target

22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
Size

220KB
MD5

0f79c1cda4b2f9230203cf1def2a9d02
SHA1

609d9c995e7d1f657d56e12c388234d76bffcb83
SHA256

22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a
SHA512

631381caeb6598ac284f0bacba3d840496a571db1573c4550ece8a2414a3c76291e0aa160b7ce38a31ce22eb34a8ccbd12b44c46f7bf10bb7e3221f77a747d3c

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\AddMount.raw => C:\Users\Admin\Pictures\AddMount.raw..doc	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File renamed	C:\Users\Admin\Pictures\DisableClear.png => C:\Users\Admin\Pictures\DisableClear.png..doc	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File renamed	C:\Users\Admin\Pictures\InvokeSet.png => C:\Users\Admin\Pictures\InvokeSet.png..doc	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File renamed	C:\Users\Admin\Pictures\UnblockSelect.raw => C:\Users\Admin\Pictures\UnblockSelect.raw..doc	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe"	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe

Drops desktop.ini file(s) 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1700	22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe

C:\Users\Admin\AppData\Local\Temp\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe
"C:\Users\Admin\AppData\Local\Temp\22abc470d761ac7d46b0b9febe33b6c3801f3d6df1e2ecac071b78247f38dc8a.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-54-0x0000000075841000-0x0000000075843000-memory.dmp

Filesize
8KB

Download
memory/1700-55-0x00000000005DE000-0x00000000005E8000-memory.dmp

Filesize
40KB

Download
memory/1700-56-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1700-57-0x00000000005DE000-0x00000000005E8000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing