Overview

overview

10

Static

static

361bd552b2...a0.exe

windows7_x64

10

361bd552b2...a0.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    26-06-2022 03:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe

  • Size

    243KB

  • MD5

    e222299ef243f72a0d45db64601146d3

  • SHA1

    e87bdc834dddd85b5b9b931eaccac03a5caabf81

  • SHA256

    361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0

  • SHA512

    683c5879edd98b9ed0b71c11bfc0857b2fe2a240d73105e78600c24352c094ceb0cdb6eb78fe22a721d4d1946c034afc0d0240b61f62038a5fd4c1bfb80dae14

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������35 B3 FE 6B 4A 40 90 9C 6F 82 2A 45 03 7E 8A 68 CC 29 A9 AE 6E 01 D7 32 5A 8C 84 21 DF BA 73 11 D4 78 2B 39 5D 0E 44 AA 96 57 09 61 1B 98 A9 EA 1A 27 9A 95 E1 41 E8 BF 1B 3D AA 14 77 BB FB 11 85 B1 33 4E 4A 9B 43 70 0C EB 41 49 69 33 C8 F4 B7 A0 1D 36 1C C3 52 E6 0D 61 28 BA 64 0B 4D 7B 1D 8C CD 2B E7 4C DA 89 9F 7D 41 4A 59 7A A6 94 0D 48 22 73 BA 2C 29 6E A3 5A EB 86 8E D6 F7 6E 6D 2C 40 4E E8 3F FF 66 EF 76 F5 1B 35 20 00 DA 86 CE 58 CD 10 08 DE C3 73 B7 92 BE 4B 09 78 81 49 2F 3C 47 94 4E EA 7D 45 95 91 61 8E 88 6A 0B 57 66 82 C4 38 47 96 A3 DE 26 01 21 5D 1A EE B0 CB EF 1A CE A0 6D 33 CE DD FB 88 A4 24 7E FA DE C5 EE 30 34 91 64 53 EA FA 77 40 00 91 46 CF 68 46 08 F1 5E 7C 37 FE 22 E4 8D 7B 31 96 EB D6 50 DE 79 60 3A 84 49 ED AB EA 06 BB AF 64 42 21 25 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Executes dropped EXE 2 IoCs
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • NTFS ADS 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe
    "C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:4800
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe:Zone.Identifier"
      2⤵
      • NTFS ADS
      PID:1912
    • C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe
      "C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe"
      2⤵
      • Executes dropped EXE
      PID:1060
    • C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe
      "C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe"
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • NTFS ADS
      PID:5032

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe
    Filesize

    243KB

    MD5

    e222299ef243f72a0d45db64601146d3

    SHA1

    e87bdc834dddd85b5b9b931eaccac03a5caabf81

    SHA256

    361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0

    SHA512

    683c5879edd98b9ed0b71c11bfc0857b2fe2a240d73105e78600c24352c094ceb0cdb6eb78fe22a721d4d1946c034afc0d0240b61f62038a5fd4c1bfb80dae14

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0.exe
    Filesize

    243KB

    MD5

    e222299ef243f72a0d45db64601146d3

    SHA1

    e87bdc834dddd85b5b9b931eaccac03a5caabf81

    SHA256

    361bd552b278cf0d956b787abd984b6c86413d668492613782f856040d8200a0

    SHA512

    683c5879edd98b9ed0b71c11bfc0857b2fe2a240d73105e78600c24352c094ceb0cdb6eb78fe22a721d4d1946c034afc0d0240b61f62038a5fd4c1bfb80dae14

    Download Submit

  • memory/1060-139-0x0000000000000000-mapping.dmp

    Download

  • memory/1912-136-0x0000000000000000-mapping.dmp

    Download

  • memory/3896-138-0x0000000000F70000-0x000000000100C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/3896-135-0x0000000006D70000-0x0000000007314000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3896-134-0x0000000006790000-0x00000000067B2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3896-137-0x0000000006870000-0x0000000006902000-memory.dmp

    Filesize

    584KB

    Download

  • memory/3896-130-0x0000000000800000-0x0000000000842000-memory.dmp

    Filesize

    264KB

    Download

  • memory/3896-133-0x0000000006720000-0x0000000006786000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3896-131-0x00000000061E0000-0x00000000063A2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/4800-132-0x0000000000000000-mapping.dmp

    Download

  • memory/5032-141-0x0000000000000000-mapping.dmp

    Download

  • memory/5032-142-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/5032-145-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/5032-146-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download