Overview

overview

10

Static

static

350542a03a...e2.exe

windows7-x64

10

350542a03a...e2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29-11-2022 00:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    350542a03ae2eab2f12f6f61abf925e2.exe

  • Size

    463KB

  • MD5

    350542a03ae2eab2f12f6f61abf925e2

  • SHA1

    b943c338607b82fcf72d398ebb317731b5c267c1

  • SHA256

    42cf8f16f7a65509a5916cd1f0b25d6192749965fe5ee32c63428cb8f63c6a75

  • SHA512

    cba2429d51c436c3a1f18bbd28a5a625810c3c11321648ac0ccbb47a511eed1c0818adbe31e3a0c2d074559044ca5536a9a92de1da1f327c923fa070a9ad6cc2

  • SSDEEP

    12288:UxkzrbETClw86ZILRaflV8jN69EpHskFgFwIyXCD:d76CxYP8j89ExskFgqIyX

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\readme.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST1GHJLMOPR 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5 ��8E 5C 68 60 55 DA 22 58 4C 99 BD 88 5F 83 BB A6 F7 B3 04 79 BF 73 D8 AF 0F 66 BF D8 1A BA 2F F6 CA CB 1A E9 5C 8E 06 CE 72 02 62 06 42 10 FD 74 6D 7A 91 F3 99 65 DE A0 01 8D 19 14 68 95 88 9E A5 F4 4D B6 B2 04 5A CA F6 04 6C 85 FE 8F 31 15 63 46 A5 A4 21 70 7B D0 95 0A C7 E4 B8 06 66 66 A9 88 40 D1 09 B6 35 04 CA 1F 02 BD 19 40 A3 78 03 7F 07 B1 CF B7 1B EC 81 C9 24 CB 02 6D 06 27 C5 DD AC E4 12 08 A7 FC 38 FF 08 EB B1 26 5F 57 2C 8B A7 C7 EE B2 B1 8D 3D E2 C8 99 03 C2 55 3B 1A 76 F1 64 2F 21 6E D4 63 CD 4F F3 0A EC 92 2B 4D 5C A0 9A CF 5E 94 9C 76 61 B5 19 BF 32 55 66 C7 E5 74 57 48 C3 D9 8D 4C FC 95 67 B7 5A EB 6E 64 43 D9 30 89 1D 3C 93 50 51 0E FF 6C 71 97 26 6E 16 C6 9A 12 4F 46 FD 64 31 41 E4 DD E4 EB 92 DD F6 C0 B5 77 09 65 00 A1 5C 0F 55 48 C3 19 74
URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST1GHJLMOPR

https://yip.su/2QstD5

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\350542a03ae2eab2f12f6f61abf925e2.exe
    "C:\Users\Admin\AppData\Local\Temp\350542a03ae2eab2f12f6f61abf925e2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Users\Admin\AppData\Local\Temp\350542a03ae2eab2f12f6f61abf925e2.exe
      "{path}"
      2⤵
        PID:864
      • C:\Users\Admin\AppData\Local\Temp\350542a03ae2eab2f12f6f61abf925e2.exe
        "{path}"
        2⤵
        • Modifies extensions of user files
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Drops file in Program Files directory
        PID:1500

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1500-59-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1500-60-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1500-62-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1500-63-0x0000000000409F20-mapping.dmp

      Download

    • memory/1500-66-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1500-67-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/1908-54-0x00000000009C0000-0x0000000000A3A000-memory.dmp

      Filesize

      488KB

      Download

    • memory/1908-55-0x00000000762F1000-0x00000000762F3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1908-56-0x0000000000890000-0x00000000008A2000-memory.dmp

      Filesize

      72KB

      Download

    • memory/1908-57-0x00000000041E0000-0x0000000004246000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1908-58-0x00000000008D0000-0x00000000008E4000-memory.dmp

      Filesize

      80KB

      Download