Overview

overview

10

Static

static

globimp_82022.exe

windows7-x64

10

globimp_82022.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    212s
  • max time network
    292s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2022 00:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    globimp_82022.exe

  • Size

    50KB

  • MD5

    fc9ca0a85e47088d25483dd47fba3244

  • SHA1

    fed2e7f2818daf55a463520ec21f337fc8679246

  • SHA256

    e8e6365ddaf5b0a40250eaab09bc61904ad5818c835ae2555c36ddc380c70ece

  • SHA512

    a4f8f0004cbcef618f5bad7ab26b83617f5107a176c68cbae6497e7acf4a36d7f690a1c9ab459d68d2d4b3153de2939857dee4ea8706d107294fcdfb67f2127c

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\read_me.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/?ST4HYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ or http://yip.su/2QstD5 Your ID �������������8B 31 21 D1 12 1C 69 C0 B5 7C 6A 82 36 48 38 4D 30 FF 60 B0 1C 55 C3 9B 13 80 29 94 08 EF F5 71 24 14 D0 E3 1E 80 8B 38 38 CB 5B CC 3B C9 79 49 AA 0A 95 46 1A 94 9B 28 D9 42 76 24 C6 BF D0 4F 1C A5 63 4D 3E 99 8F E6 F6 99 0D 64 DF 62 E6 E0 64 5C 24 81 27 8D 48 C0 CF B1 67 C9 18 D7 38 3A 2E 3D 78 82 7A 50 95 D4 0F A1 5A 07 C4 2B 28 F6 77 43 74 6F 93 CC 26 C3 73 E6 5C A3 C2 09 0D 06 8A E6 9C 68 C4 33 38 10 59 72 C2 1F 1C C9 CA A5 C0 D2 8D 2B 3E B5 F5 34 26 7D 39 A5 C3 97 F3 02 75 46 E5 A0 46 FA 51 3A F8 A2 8A EA 7E 28 D0 25 5F 27 38 25 63 27 61 B7 74 5D 4E CD 03 55 64 47 6A 92 DF 34 E9 59 6D 9A DD A1 B4 B6 24 B7 4D FB 56 B4 22 3E 33 39 C8 B7 D2 06 D5 D0 9C E8 2A 18 39 27 69 70 AE 32 A6 68 62 AE 66 56 0A 73 81 78 6C 5F D7 A3 B3 3D FC D1 19 4F 32 59 8E CF C4 8A
URLs

http://mrv44idagzu47oktcipn6tlll6nzapi6pk3u7ehsucl4hpxon45dl4yd.onion/?ST4HYJUHGFV

http://yip.su/2QstD5

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 17 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\globimp_82022.exe
    "C:\Users\Admin\AppData\Local\Temp\globimp_82022.exe"
    1⤵
    • Modifies extensions of user files
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\globimp_82022.exe > nul
      2⤵
        PID:3156

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\desktop.ini
      Filesize

      1KB

      MD5

      985b5d2008cb9707f236b9dfc5a352f1

      SHA1

      7701f973f6bc93b60e17a711db9d8959049093d5

      SHA256

      48652ae920a45a4eac4aab89254dac5f2122294582eafe0940de1725ea70727e

      SHA512

      a52e9e9c013cc9a64b2af9df5c947c73cdd78e019b62981550e4170bb8562bcec2d869c7e371781da20f7b0c202c444e5d95d651b491ff95092ccb2aae321402

      Download Submit

    • memory/5024-132-0x0000000000400000-0x000000000040D400-memory.dmp

      Filesize

      53KB

      Download

    • memory/5024-133-0x0000000000400000-0x000000000040D400-memory.dmp

      Filesize

      53KB

      Download