Overview

overview

10

Static

static

star.exe

windows7_x64

10

star.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    26/06/2022, 06:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    star.exe
  • Size 360KB
  • Sample220626-gsbdmabdf2
  • SHA256 59e0ab333060b4e510db5d36d87f0fe267ab66b0881955649b06d91d6dd2d486
  • MD5 SHA1 SHA512
Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\read-me.txt

  • globeimposter

Ransom Note
  • All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://helpqvrg3cc5mvb3.onion/ Your ID ���02 67 2E 9B C9 FE 3A 87 64 AA 6D 2A 6B 12 6A 5E F3 E5 3C FC E4 BB F4 EE 5A F0 C5 FA F4 D3 54 35 86 73 F0 BD C4 1C 04 E0 6C 7D C3 49 32 D6 2E FE 97 51 EA 89 E5 37 F3 B1 3C 91 E3 A1 12 89 39 F3 8E B7 FF 2D 96 94 36 96 A0 06 7B 65 99 07 A6 18 36 E1 14 CF 99 DD 9D 9D 3C 15 2D A0 39 8E EE E8 C0 E1 2F 25 7E 7E BA 7A E4 FA 06 0B 08 59 8D F0 BA D2 43 BE E2 1C A5 FA 51 53 B6 8F 74 FB 3C B4 E1 CF 0C 6F FC 57 28 A8 00 42 C6 E4 81 52 FA 89 52 30 1D 1E 06 43 E1 C5 77 C6 FE FA D9 70 A6 99 44 05 E6 C0 48 18 BB AD B2 1F B7 8F 43 33 8A 86 7E 30 7D 1C 2A D5 19 BB E9 64 6C EF 9C 21 65 27 AA 12 5E 87 69 63 63 60 6B 35 90 DE 5B 22 21 7B 63 7B B8 38 4F 2B 69 3D 4A 77 DB 5E D9 C1 90 C2 D4 00 00 CD 4D 64 4B 80 AA 86 15 42 EA 9A CC AB 11 CC CD 87 9B 63 66 FE 50 21 A3 CF 9F 71 65 95
URLs

  • http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?STAHYJUHGFV

  • http://helpqvrg3cc5mvb3.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\star.exe
    "C:\Users\Admin\AppData\Local\Temp\star.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jVYbanglCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFC2B.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:360
    • C:\Users\Admin\AppData\Local\Temp\star.exe
      "{path}"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:1720

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        tmpFC2B.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmpFC2B.tmp
        • Size 1KB
        • SHA256 68be26cec28d3e64f867678c40994352ad27b2e92c0c7db9fdaf068b290541ee
        • MD5 SHA1 SHA512
        Submit Download

        jVYbanglCI.exe
        • Path C:\Users\Admin\AppData\Roaming\jVYbanglCI.exe
        • Size 360KB
        • SHA256 aa0166ba48688fe1acc9152a42a2fbdf023c15a3485118892ed51dbe9a97cd88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1720-64-0x0000000000400000-0x000000000040E000-memory.dmp
        Download

        memory/1720-61-0x0000000000400000-0x000000000040E000-memory.dmp
        Download

        memory/1720-62-0x0000000000400000-0x000000000040E000-memory.dmp
        Download

        memory/1720-68-0x0000000000400000-0x000000000040E000-memory.dmp
        Download

        memory/1720-69-0x0000000000400000-0x000000000040E000-memory.dmp
        Download

        memory/2024-58-0x0000000000C20000-0x0000000000C32000-memory.dmp
        Download

        memory/2024-57-0x0000000005A80000-0x0000000005AE6000-memory.dmp
        Download

        memory/2024-56-0x00000000006B0000-0x00000000006BA000-memory.dmp
        Download

        memory/2024-54-0x0000000000C60000-0x0000000000CC0000-memory.dmp
        Download

        memory/2024-55-0x0000000075B71000-0x0000000075B73000-memory.dmp
        Download