Overview

overview

10

Static

static

5c1d83ab58...19.exe

windows7-x64

10

5c1d83ab58...19.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    170s
  • max time network
    193s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-08-2022 15:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c1d83ab5883129f137ee29c9353a316184243828c2ac79b0c6f6997cff19919.exe

  • Size

    564KB

  • MD5

    e3c7ad2aa9fb8627409137f52a0e0980

  • SHA1

    2a3160aeb85904ff5cc52242b9553d3f9198ec92

  • SHA256

    5c1d83ab5883129f137ee29c9353a316184243828c2ac79b0c6f6997cff19919

  • SHA512

    8890d121bc4599a1fd9a59c3e99b957340d94e75ffe22f12c302a62a32a5270579e59c51cc024352ee321b559f254b9ae95e07c47b3b1c7307a2331846ef62fc

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������6A 34 AF CB B3 EF 9B 5F F4 BF 7B D5 0A 8A B9 C0 9C A3 AC E5 5D 7D 7A A9 AA 0A B1 98 6B 31 B2 79 F2 54 27 C7 4C E8 3B 3A 3A 99 8A D6 9C 73 D8 70 C1 2D 5D E6 C0 E1 49 60 66 46 E7 9F 41 A4 27 1D B6 6E D1 EC E1 32 8C DA FD 15 C0 6B 13 D6 71 A4 05 75 CD 3A D0 BD BE E1 78 9E 18 87 15 B8 C8 02 10 59 D1 9E 61 72 46 6E 45 65 1D D6 66 6B 57 1C 77 38 D1 41 4F E6 9F 59 E5 B4 46 75 D4 2A A7 B4 C9 9E E6 6B 40 DB AC ED 24 15 3D B0 D6 00 3B 3B B4 87 C5 EB 19 4D 0C 9E DB EB 0E F3 66 A9 E1 37 43 E5 C6 53 5E A4 30 8A 22 F5 D7 D2 13 BE FB 6C AB 24 E9 02 68 88 9B AA 63 3F 3B BC 44 08 DF F6 E7 1F C5 D8 29 96 41 D8 9B 58 52 D1 A5 89 B5 09 32 56 20 BF 65 E9 C6 20 00 76 59 18 53 A9 26 09 C1 FF 28 97 49 A7 E2 6A C3 A7 6F 3E C9 28 09 78 0A 8C 6F 3A 0B 94 9B A1 7B CE A6 4E E0 B7 8F 2C ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c1d83ab5883129f137ee29c9353a316184243828c2ac79b0c6f6997cff19919.exe
    "C:\Users\Admin\AppData\Local\Temp\5c1d83ab5883129f137ee29c9353a316184243828c2ac79b0c6f6997cff19919.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Users\Admin\AppData\Local\Temp\5c1d83ab5883129f137ee29c9353a316184243828c2ac79b0c6f6997cff19919.exe
      C:\Users\Admin\AppData\Local\Temp\5c1d83ab5883129f137ee29c9353a316184243828c2ac79b0c6f6997cff19919.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:2628

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/768-136-0x0000000077B90000-0x0000000077D33000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/768-132-0x0000000002290000-0x0000000002297000-memory.dmp

    Filesize

    28KB

    Download

  • memory/768-134-0x00007FFE06D90000-0x00007FFE06F85000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/768-135-0x0000000002290000-0x0000000002297000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2628-138-0x0000000077B90000-0x0000000077D33000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2628-137-0x00007FFE06D90000-0x00007FFE06F85000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2628-140-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2628-139-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB

    Download

  • memory/2628-141-0x0000000000400000-0x000000000048F000-memory.dmp

    Filesize

    572KB

    Download

  • memory/2628-142-0x00000000004D0000-0x00000000004D7000-memory.dmp

    Filesize

    28KB

    Download

  • memory/2628-143-0x00007FFE06D90000-0x00007FFE06F85000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2628-144-0x0000000077B90000-0x0000000077D33000-memory.dmp

    Filesize

    1.6MB

    Download