globeimposter | 3d8b538a62473db2cd132f6eded5ba1c81c1d04702a40399a702c514247c12dc

General

Target

file.exe
Size

646KB
MD5

fac0564b69ab03050cf82098f98317e1
SHA1

01d6d9b1acd7c97ddf53fe704bfdd7a587f8884f
SHA256

3d8b538a62473db2cd132f6eded5ba1c81c1d04702a40399a702c514247c12dc
SHA512

31723a2f2e90486ba567a7875a406ff548449966a9beb3b795761859f1c4a5b5950c92946d3c74d6d4410057c03d6c22d3bce1710a7099af35fd1d5eee14feb7
SSDEEP

12288:n/fHh2vI2amObUyGDWC7V3zuemBkCljzJVYPzzHuuf9F/Xriz5yP:n/pBmObUXDFykChJVszzH9z/7iz5yP

Score

10^/10

globeimposter persistence ransomware

Malware Config

Extracted

Path

C:\readme.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST2GHJLMOPR 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5 ��1B 86 1E 08 63 40 0F FA FE C7 52 6C EB 9E 52 0C DC 66 BF 0C B7 8C DF 47 A6 0B 2F E5 46 03 4B C2 B3 2E F3 B9 8C 02 16 33 64 EF 3E 36 69 10 D2 B3 E6 17 23 9A B9 13 4C 62 5A C9 C4 7D F0 DC B1 D6 E4 7A 8C C9 AA C0 38 ED 06 8A 86 F3 D3 79 3D DB E8 20 68 E8 F1 2B 4E A5 A2 1E 51 26 49 6C DF 27 92 3F 8A A9 27 D3 A4 72 1B 93 A6 3A BA 7F FB A8 99 71 FA 03 91 53 72 74 6A 98 C1 51 D8 79 BC F7 7B 4E 1F C7 22 09 86 33 7E 67 84 CC 24 B5 1E 67 34 5A DA 3B 6D 26 16 90 29 95 FE 6F EC 9F 54 40 27 8F 4E 2C 30 3A C0 EA F9 5F 3C 12 06 D6 57 A5 1C 33 41 D0 37 20 22 5D B0 73 08 70 33 16 D2 41 EB A9 71 38 1D 3F 6D 1B A9 D0 14 13 9B 5E F0 8B D7 F5 83 C7 AC F1 37 DE 1B 44 AC D6 2F B3 C0 8F E0 0F 66 C5 AC 31 5D 83 E4 AA BB 73 21 57 3A 8E 2A 48 91 1E 60 73 BC 83 0F AD EA 7D 3C 5A 08 08

URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST2GHJLMOPR

https://yip.su/2QstD5

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	file.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\file.exe"	file.exe

Drops desktop.ini file(s) 13 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	file.exe
File opened for modification	C:\Users\Public\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	file.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1792	1492	file.exe	28

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1792	1492	file.exe	28
PID 1492 wrote to memory of 1792	1492	file.exe	28
PID 1492 wrote to memory of 1792	1492	file.exe	28
PID 1492 wrote to memory of 1792	1492	file.exe	28
PID 1492 wrote to memory of 1792	1492	file.exe	28
PID 1492 wrote to memory of 1792	1492	file.exe	28
PID 1492 wrote to memory of 1792	1492	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  PID:1792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-54-0x0000000000C40000-0x0000000000CE8000-memory.dmp

Filesize
672KB

Download
memory/1492-55-0x0000000076771000-0x0000000076773000-memory.dmp

Filesize
8KB

Download
memory/1492-56-0x0000000004C70000-0x0000000004D1E000-memory.dmp

Filesize
696KB

Download
memory/1492-57-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/1492-58-0x0000000005B00000-0x0000000005B68000-memory.dmp

Filesize
416KB

Download
memory/1492-59-0x00000000009E0000-0x00000000009F4000-memory.dmp

Filesize
80KB

Download
memory/1792-60-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1792-61-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1792-63-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1792-67-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1792-68-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing