Overview

overview

10

Static

static

globimp_82022.exe

windows7-x64

10

globimp_82022.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    186s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19-08-2022 00:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    globimp_82022.exe

  • Size

    50KB

  • MD5

    fc9ca0a85e47088d25483dd47fba3244

  • SHA1

    fed2e7f2818daf55a463520ec21f337fc8679246

  • SHA256

    e8e6365ddaf5b0a40250eaab09bc61904ad5818c835ae2555c36ddc380c70ece

  • SHA512

    a4f8f0004cbcef618f5bad7ab26b83617f5107a176c68cbae6497e7acf4a36d7f690a1c9ab459d68d2d4b3153de2939857dee4ea8706d107294fcdfb67f2127c

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read_me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/?ST4HYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://yip.su/2QstD5 Your ID �������������AD 1B CE E5 28 13 63 64 49 98 87 D7 E1 28 A8 4C 2B B6 CC C7 11 D0 7F DB EE E5 AB 8F 69 44 93 B3 C9 C1 D0 A1 3F C0 4B 15 77 3B 3F 96 FC 9B 70 8D C0 7D E9 C1 96 20 CD EB C5 FE F2 EC D7 58 5E 82 A9 FF A2 C5 6A D3 1F D9 DD 7F 50 19 EC 33 F7 15 FB 86 91 A5 B5 2E 9F 05 DE 21 B6 47 CF 10 8C 53 CE 82 DD 3E 01 14 1E 35 B5 C0 4C C0 7C AD E0 31 DD 56 8F 22 A4 B7 98 A4 2E 7D B2 15 43 F3 54 C3 B0 F8 83 61 83 E6 45 62 5F 57 A0 90 14 5C AB CF C2 02 F0 D2 BB DC F8 34 3E DC 72 A8 06 E9 6E E6 C1 D7 88 49 52 FE 56 D2 8B 99 26 D7 1D 94 15 B7 66 1F 8A 2E E9 5A A4 67 BE 87 D4 5A A8 1D 96 E4 6E CB E4 0A 00 73 E9 0C 3B 40 13 91 79 17 9F BD 48 A9 E4 13 99 8C 9B 70 95 A4 76 77 5B 8B 91 81 CB D5 78 94 BA A2 A5 B3 BE 43 0C D3 08 14 44 51 1B 5F 78 57 71 C3 D3 DF 29 E9 68 EE 24 5A C5 51
URLs

http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/?ST4HYJUHGFV

http://yip.su/2QstD5

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 13 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 37 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\globimp_82022.exe
    "C:\Users\Admin\AppData\Local\Temp\globimp_82022.exe"
    1⤵
    • Modifies extensions of user files
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\globimp_82022.exe > nul
      2⤵
      • Deletes itself
      PID:1208

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2591564548-2301609547-1748242483-1000\desktop.ini
    Filesize

    1KB

    MD5

    43d35e38b3ea183d92c33bae3caa38a3

    SHA1

    4610cafceda1d7fadcfb1d444dd66095eb164f7a

    SHA256

    e6a69ce19effd2116106dbd031a9f2f897e41980f02b904b9ced37b5458c7e6c

    SHA512

    d9156f964efb2c873908382a5c46d4c2e7701ef573a5d0b00cc04aef05ba58c2f2ab64985132aa624143389447e04451ae44b8af86ad01ed561f4421127e59c6

    Download Submit

  • memory/1916-54-0x00000000759E1000-0x00000000759E3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1916-55-0x0000000000400000-0x000000000040D400-memory.dmp

    Filesize

    53KB

    Download