Overview

overview

10

Static

static

35fc2092e4...ef.exe

windows7-x64

10

35fc2092e4...ef.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-08-2022 09:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    35fc2092e400f3e94384de93ca5f4293f1bc6607a76b20d4702c0372eea132ef.exe

  • Size

    170KB

  • MD5

    c6b7bfd71bd9266d2f6a7765d792e8f5

  • SHA1

    cfecd233b084e49d66ac63943e7370bdcb3afdef

  • SHA256

    35fc2092e400f3e94384de93ca5f4293f1bc6607a76b20d4702c0372eea132ef

  • SHA512

    0b0bba5bb84de2be5f983438ff05fdef4d66aff7302045858254a50b8e75fdd1329a9edd90ad463b0a94087c84f7fd93ac96bb8a688b6f159d5c2e5e845298a0

  • SSDEEP

    1536:J7kSVXrB7T0hoAOwC6NXFZcRGOgaRFOvA+v/T3YpKuz:9z1/0POX6NvPaRFOlv/k

Score
10/10
globeimposterpersistenceransomware

Malware Config

Extracted

Path

C:\readme.txt

Family

globeimposter

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST4HYJUHGFV | 3. Create Ticket ---------------------------------------------------------------------------------------- Note! This link is available via Tor Browser only. ------------------------------------------------------------ Your ID ���������71 DA F2 65 19 8C 82 DC BD F0 53 B2 E1 A0 82 E3 EE 01 F9 2E D0 99 ED 73 DD D4 D8 00 D6 CE DA 18 39 CC AA 60 2B AB E2 30 B1 CF 29 52 82 EC 55 65 EC BE 7F 46 11 8F D1 C0 2A BF 6A EB 52 6D 31 F2 25 7F 3B 6E 4F 8E C6 9A 49 1A DE 54 9D 7B 68 CA 36 3F CE DF B8 B6 9F 1D B7 3A 40 05 1A A3 AB DF E0 71 FA 0E 91 E2 26 B4 FB 40 DA D8 88 2B 1D 01 01 6F 29 B4 D6 5C 44 DE 55 39 D6 10 A8 6D 39 62 F3 66 B5 58 E2 B0 5F 20 1E 30 87 AC 87 21 90 15 D4 BD 7C 2B 6E B4 29 7C C7 4F 44 81 8F A6 4C DD 18 BB DD 52 0B BC E9 4E 76 2B 91 2D CA E8 E7 01 0E A3 03 8B BA ED 36 30 EF 0F 80 DC 66 17 D6 18 19 56 8E 6F 33 9F D7 88 4F 9B 78 AF 0F 5E 67 7F E0 82 14 62 EB 5E 57 35 FA 19 22 A8 81 DD E1 97 2D E3 62 F4 56 84 DB 5C 9D C8 A5 69 F3 91 0C 22 43 34 04 AC 53 A8 3B 75 25 D6 73 13 17 2B 00 AD
URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST4HYJUHGFV

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35fc2092e400f3e94384de93ca5f4293f1bc6607a76b20d4702c0372eea132ef.exe
    "C:\Users\Admin\AppData\Local\Temp\35fc2092e400f3e94384de93ca5f4293f1bc6607a76b20d4702c0372eea132ef.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      • Suspicious behavior: RenamesItself
      PID:2968

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2968-134-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2968-136-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2968-137-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3988-132-0x0000000000430000-0x0000000000460000-memory.dmp

    Filesize

    192KB

    Download