Overview

overview

10

Static

static

359dba8d27...6a.exe

windows7_x64

10

359dba8d27...6a.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    26-06-2022 23:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe

  • Size

    471KB

  • MD5

    68ae1cfdc0b53730b7ad43781155e598

  • SHA1

    fb4b60e97cb4445957d74de46b842e7d51ae950c

  • SHA256

    359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a

  • SHA512

    0dbf148442cee19da08d6a5033013098e75f31c79057d2b2a76e43bfbde6e60aba495d12aeb69be31eb60c8e20e48256e93f62e0e4453c573d240fb37db710f7

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������56 42 28 D6 05 CA 91 48 8F 81 1C 5C 3A 61 8D 04 4F B4 02 57 AA 2E 5B C0 69 15 A7 29 8A 38 B0 F7 60 4B 3A 75 FE 4E BB 39 AD C8 F6 33 F6 27 B3 37 CD 63 56 DA 00 CE 4E 3F D6 77 FD 2B EA 87 A3 F0 4C CF 4A A9 8C 3F 24 CC 94 35 02 D7 36 BA 4A A1 16 F8 B9 D7 27 AF 25 7C D6 77 AC C9 AD A8 4B D9 13 92 24 3C 28 7C BF 9E 3B 9C 2D 0C 79 BB 7C 58 AD 62 DA 93 F2 E0 2F 8C 58 6D 29 8F DF 46 A7 1A CA 3C 7D D8 3F B0 43 4C 2F 37 A3 BE 49 E5 80 E1 B6 07 0B 32 81 23 8C C1 11 0F F2 73 83 25 8B 3D 6C A4 4C CF 82 A4 71 D8 5E F9 8B 57 B4 6C 0D 03 0D 43 1B 21 09 CA 6D 88 2D 6A F2 81 07 7A B7 CE 93 D3 91 9F 37 04 29 CB AC 92 EC BE 06 E1 39 2E AE 10 64 58 2C 3D 72 73 AA 0C B3 B7 17 B0 81 24 53 B2 D9 AC BB 44 4E 28 27 9C A4 A0 BF 46 AD FA 3A 78 EE C9 09 FD 68 28 F7 C8 42 5F 16 4F 39 51 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe
    "C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4828
    • C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe
      "C:\Users\Admin\AppData\Local\Temp\359dba8d2718cae69e16a4dbb97bd01673d65efc5715ea935ce395679ee3516a.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:4456

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4456-134-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4456-135-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4828-130-0x0000000000EFA000-0x0000000000F00000-memory.dmp

    Filesize

    24KB

    Download

  • memory/4828-131-0x0000000000EFA000-0x0000000000F00000-memory.dmp

    Filesize

    24KB

    Download

  • memory/4828-133-0x0000000000EFA000-0x0000000000F00000-memory.dmp

    Filesize

    24KB

    Download