Overview

overview

10

Static

static

173515afd6...ca.exe

windows7-x64

10

173515afd6...ca.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2022 03:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe

  • Size

    514KB

  • MD5

    333692f4aa893a0f1c2f5e0fb6b23737

  • SHA1

    5a951cf930941b88bf4dd250f37f178c4f94c5c1

  • SHA256

    173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca

  • SHA512

    5492f23abf615f62f7b1a43aef1713bb55ecc72d8aa9a0399d97b0f24f116bbf237962de894e9a014a7a13795843d8c1d42b599c89955fd5309270751284d631

Score
10/10
globeimposterlockbitpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������94 0F FB 8F 3D 51 74 F1 79 7B AB C4 6A 19 6C 3C 09 58 65 7A A8 16 90 31 65 71 B4 1E 74 B4 8F CB 75 EC 4E 99 D6 0F E6 6B 03 38 8A 9C 88 AB 42 F0 B9 57 C2 24 B9 77 53 C6 5B 55 0F C9 BA 8E D2 1F C5 62 11 D1 B4 A0 BE D2 5B DE D4 30 5A F2 19 4E 57 8C 7E 03 B6 EF F4 C2 F4 FF 50 BC 82 28 2B 3A 2C BE A0 CA 06 3B 26 9D 6E 97 67 42 D4 CF 97 28 30 8C EA BB 42 76 37 BA 6A 26 64 8D 30 4D 90 6E AF B4 41 1C 22 C2 29 A2 14 21 84 8F 48 E0 C3 C3 9A 1F 52 76 9C 99 68 4D 0D 6C 93 0C 18 AC 77 95 92 A4 A3 99 BB 60 5F 67 C8 F3 5A 2C 43 3F C6 C3 85 65 FE 0D 60 AF 31 FE DE 20 B2 78 63 0E 35 BB 8D D1 27 B9 47 86 41 F9 4C B6 9A 4A D5 C2 1C AE 25 33 21 BA 33 E3 42 12 E2 DA 59 A8 02 E9 13 B4 F0 B6 18 39 89 F2 50 26 4C 3C BD BB 97 13 96 D6 28 0D 2D CA CE 7E F8 14 41 76 FA F0 7D 87 C8 5E ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Modifies extensions of user files 9 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe
    "C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2080
    • C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe
      "C:\Users\Admin\AppData\Local\Temp\173515afd6301b429f9dab54894aeaf1285e59d25c0a9795eb352b8693c902ca.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:1628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1628-131-0x0000000000400000-0x000000000040D600-memory.dmp

    Filesize

    53KB

    Download