globeimposter | 5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b

General

Target

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
Size

281KB
MD5

a0ad66bbe2af5c64af859ed1b250e145
SHA1

5a85f7fa7ed7b2c706b3bbfb8f42fba757420c0f
SHA256

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b
SHA512

ab20e4f71c17dfea5b5ceb891add576d4de86da2c452ab2e754605c3ee47978a2d37b1780d2fabed44ddd8648b8b558f4273ae6eede316cddeabb668d01a8963

Score

10^/10

globeimposter persistence ransomware

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note

All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###��36 CF CD CD F7 6E 73 C0 AD AF 14 46 DB BF 94 4B 51 43 9D D0 CE 64 EB 45 70 BB 16 62 88 30 F8 77 D2 26 71 89 E3 D1 88 2B 20 54 7D 33 E6 A7 11 2A 04 F9 EF 57 F0 13 18 56 9C DE 45 2C 8C 80 B4 71 76 46 08 8C C3 8A 8D 68 90 40 14 69 51 B6 A5 BB 99 E8 46 74 86 3B 25 AE 73 A7 68 3C 6D A2 84 9C EB 98 5D 1A E6 82 3A B1 DF 54 B5 FD CD 94 03 1B 1C 19 BF 1F D0 E4 B1 2B 12 B8 3A D0 10 6D 86 CB 5F 32 19 7A EB 9E E7 25 67 28 5F 42 AC 36 EB D6 FF F9 F4 97 5D CC 7D 1C 8C E0 89 59 AB BA 6E 97 71 0F 18 DE BF 88 0A 24 43 CA 12 01 78 2C 76 A9 9C 2E 84 A2 69 28 14 21 17 1B 2D BA 4A D3 5E 4D 9B C9 15 64 3B 8F 72 2C DE 49 19 8C E4 49 B5 C5 B5 05 A4 0B EC BD 0F C7 B8 6B 53 0E 63 00 70 34 B6 47 BC 17 F2 BE 3C 64 08 9F F4 4F F4 4B 84 24 CD 3E 45 CE 1C 23 57 9C A9 EF BB F0 CB 36 EA 27 ###��

URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Executes dropped EXE 1 IoCs

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

pid process

4572 5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

pid	process
4572	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe"	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Drops desktop.ini file(s) 12 IoCs

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	ioc	process
File opened for modification	C:\Users\Public\Libraries\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	pid	process	target process
PID 4464 set thread context of 4572	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 3 IoCs

Processes:

cmd.execmd.exe5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe\:Zone.Identifier:$DATA	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description pid process

Token: SeDebugPrivilege 4464 5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	pid	process
Token: SeDebugPrivilege	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	pid	process	target process
PID 4464 wrote to memory of 3136	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 4464 wrote to memory of 3136	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 4464 wrote to memory of 3136	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 4464 wrote to memory of 4768	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 4464 wrote to memory of 4768	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 4464 wrote to memory of 4768	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 4464 wrote to memory of 4572	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
PID 4464 wrote to memory of 4572	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
PID 4464 wrote to memory of 4572	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
PID 4464 wrote to memory of 4572	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
PID 4464 wrote to memory of 4572	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
PID 4464 wrote to memory of 4572	4464	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
"C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier"
2⤵
- NTFS ADS
PID:3136

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier"
2⤵
- NTFS ADS
PID:4768

C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
"C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- NTFS ADS
PID:4572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Filesize
281KB

MD5
a0ad66bbe2af5c64af859ed1b250e145

SHA1
5a85f7fa7ed7b2c706b3bbfb8f42fba757420c0f

SHA256
5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b

SHA512
ab20e4f71c17dfea5b5ceb891add576d4de86da2c452ab2e754605c3ee47978a2d37b1780d2fabed44ddd8648b8b558f4273ae6eede316cddeabb668d01a8963

Download Submit
memory/3136-132-0x0000000000000000-mapping.dmp

Download
memory/4464-130-0x0000000000D70000-0x0000000000DBC000-memory.dmp

Filesize
304KB

Download
memory/4464-131-0x0000000005A20000-0x0000000005A86000-memory.dmp

Filesize
408KB

Download
memory/4464-133-0x0000000006280000-0x0000000006442000-memory.dmp

Filesize
1.8MB

Download
memory/4464-134-0x00000000060F0000-0x0000000006112000-memory.dmp

Filesize
136KB

Download
memory/4464-135-0x0000000006A00000-0x0000000006FA4000-memory.dmp

Filesize
5.6MB

Download
memory/4464-137-0x0000000006450000-0x00000000064E2000-memory.dmp

Filesize
584KB

Download
memory/4464-138-0x0000000001560000-0x00000000015FC000-memory.dmp

Filesize
624KB

Download
memory/4572-139-0x0000000000000000-mapping.dmp

Download
memory/4572-140-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4572-143-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4572-144-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4572-145-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4768-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads