Overview

overview

10

Static

static

359dba8d27...6a.exe

windows7_x64

10

359dba8d27...6a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26-06-2022 23:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe

  • Size

    471KB

  • MD5

    68ae1cfdc0b53730b7ad43781155e598

  • SHA1

    fb4b60e97cb4445957d74de46b842e7d51ae950c

  • SHA256

    359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a

  • SHA512

    0dbf148442cee19da08d6a5033013098e75f31c79057d2b2a76e43bfbde6e60aba495d12aeb69be31eb60c8e20e48256e93f62e0e4453c573d240fb37db710f7

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������4C 43 00 DF 3F 98 BB 08 3F 1D 3B AF 4D 50 54 FB 5B 69 65 B3 DF E4 1A E8 6F E8 BE 79 61 5F 22 7A D1 E3 40 98 71 EC 5A B2 BD 0E 5C 70 25 EE F1 1C 2B FD 36 12 07 4F 3C DA 22 2C 3B ED 95 39 A5 C1 F3 C5 CE E9 60 84 5E 7C E3 B2 7E 84 70 8F AE 77 28 DE 0A 13 E7 5C B7 37 BF EE E6 95 99 A3 E7 37 2F B7 51 02 16 8F 9F 4D 85 85 D4 DC EB 0B 51 2C FF 9B 6A B3 EA 7F 7E E1 50 0E A8 0A 2D 5F DF 0D 95 03 36 F8 6D DB 58 8C 75 AB B9 60 55 3B A1 8B F6 53 C3 73 1D 44 C1 AD A5 7C AF ED 01 CB 21 8A E2 D5 C7 0E BE D8 FA C9 BB 46 6F 36 DD 66 F0 ED 75 AE 8A A8 30 27 B3 DA F2 64 C9 7A 22 17 69 68 6C 78 8F B9 9D 37 AF 5A E1 B2 68 AD C7 05 BF D5 3B 67 4B E1 56 51 11 90 86 88 E0 23 59 33 21 57 92 60 C6 D5 20 0E 93 79 E8 4A 77 28 E7 7A 41 CC AF 81 E9 53 C2 80 FA 50 3F 72 C5 AC F4 A6 5F 73 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe
    "C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe
      "C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/980-59-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1824-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1824-55-0x0000000000399000-0x00000000003A0000-memory.dmp

    Filesize

    28KB

    Download

  • memory/1824-58-0x0000000000399000-0x00000000003A0000-memory.dmp

    Filesize

    28KB

    Download