Overview

overview

10

Static

static

215afd5082...bf.exe

windows7_x64

10

215afd5082...bf.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-06-2022 08:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe

  • Size

    256KB

  • MD5

    18110f51034492e14fc11dc9afa19d46

  • SHA1

    efa6ac306cbb3dcea1d4082bc17feb6e17957e4b

  • SHA256

    215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf

  • SHA512

    5c6cc348f4d64b561aab2bdce05d9b5c71907044562c6950c480d37b7691ace9f3d9ca74e64971d77e46bb009cc1c7566a92f58443af0b65811c94d210965594

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������84 D7 9F B2 F4 80 1E 25 F3 E8 09 DC DA 2A BF 75 30 4E 77 19 68 1B 42 28 E2 BB FA A0 E3 40 19 77 41 FF 03 56 2F 2D A1 C1 89 E8 43 19 19 25 77 BE 6E 24 64 D8 1B 49 DB 33 D9 2F A4 14 5F BE 01 29 E3 9A B5 BB E3 84 B4 78 17 D2 91 9F 41 10 80 CC E3 4A 63 3A B1 32 40 8C B6 BF 6C 10 2B FB AF BD 1C 01 E9 84 35 C2 2C B0 B1 1D EF 68 31 78 31 F1 6F 2D F6 7C 88 08 DF 47 87 2B 9D AA 89 94 95 D3 B6 90 1E 95 BD B4 76 5B 3D CB 9E 8E 49 7A 0B 48 EF C0 81 42 7A 58 6B 05 B4 51 B3 24 25 AA 88 BE 08 0E 33 DC 38 FA 03 91 48 EC 6D A1 E8 97 0F 4A 95 C8 2F 6B 0B E5 8F 77 42 9A 6F A0 C3 28 5D F5 DA D0 41 C3 51 D5 E8 64 12 1D 46 3F BC D6 2C 42 CC 4E 0B ED 46 20 65 6B 4E C4 71 A5 64 AC 68 7B 5C F4 16 B3 46 66 2D 93 E7 A1 9C 98 E8 54 C2 2B 68 E6 52 83 26 77 1D 83 2F DB A3 EF CF DA DC E6 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • NTFS ADS 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe
    "C:\Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:780
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:2016
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:268
    • C:\Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe
      "C:\Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • NTFS ADS
      PID:1068

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe
    Filesize

    256KB

    MD5

    18110f51034492e14fc11dc9afa19d46

    SHA1

    efa6ac306cbb3dcea1d4082bc17feb6e17957e4b

    SHA256

    215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf

    SHA512

    5c6cc348f4d64b561aab2bdce05d9b5c71907044562c6950c480d37b7691ace9f3d9ca74e64971d77e46bb009cc1c7566a92f58443af0b65811c94d210965594

    Download Submit

  • \Users\Admin\AppData\Local\Temp\215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf.exe
    Filesize

    256KB

    MD5

    18110f51034492e14fc11dc9afa19d46

    SHA1

    efa6ac306cbb3dcea1d4082bc17feb6e17957e4b

    SHA256

    215afd5082700778508aef3e9d40b242206dab74801a1d13d3a59dbb1168dfbf

    SHA512

    5c6cc348f4d64b561aab2bdce05d9b5c71907044562c6950c480d37b7691ace9f3d9ca74e64971d77e46bb009cc1c7566a92f58443af0b65811c94d210965594

    Download Submit

  • memory/780-58-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/780-54-0x0000000000B70000-0x0000000000BB4000-memory.dmp

    Filesize

    272KB

    Download

  • memory/780-60-0x0000000004290000-0x000000000429C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/780-61-0x0000000000910000-0x000000000091C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/780-56-0x00000000004B0000-0x00000000004DA000-memory.dmp

    Filesize

    168KB

    Download

  • memory/780-55-0x0000000074E91000-0x0000000074E93000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1068-63-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1068-64-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1068-66-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1068-71-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1068-72-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download