Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-12-2022 04:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f46d1ec2c56550f33b4f30f7f0763503b5a59e0004666de62c9483a0b4dfcac7.exe

  • Size

    817KB

  • MD5

    04552db2a9d8be2843b2d03fee3772a5

  • SHA1

    5be03fb16f18a8ab2a911833e602cdcd2b2c34f5

  • SHA256

    f46d1ec2c56550f33b4f30f7f0763503b5a59e0004666de62c9483a0b4dfcac7

  • SHA512

    34b9c1aab0abb06b4c91d4a15b3c8e259e6dd6a134b00ff077969c01999ea13c50ae7144571121d93fcecd9c14e2b0f958ceaeae0b4ee61edf6d794cbbfecd5c

  • SSDEEP

    24576:6h/AKI2l60YNHkxjmGymEGsqMDxwg5+Ro:k/pXIExSKEZqM7e

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\readme.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST1GHJLMOPR 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5 ��C3 1E 7A 44 49 2D 3C 0D D6 A9 57 E1 2A FA C3 4A 69 FA 00 55 19 66 80 4E 0F 50 F6 C2 C7 75 B6 57 61 68 1D 78 70 A5 41 8A E1 16 20 78 78 17 A5 1B 8C AE 5C 38 31 1A 92 7C 8C 3A C6 83 DF DD 5E 2E FA B1 ED 73 82 8A 08 2D 31 62 33 AB 81 42 F4 D4 9D 53 96 EA D4 EE 39 83 FF 97 2F BD 85 88 94 AD 82 2C 95 88 BA B8 0D 54 52 21 05 FC AA 32 FC C6 EC 16 B0 D0 A1 8F 01 8A E7 C0 E3 16 5A 67 6B D3 48 C6 AA FA 50 59 CA FF C0 EA 3D 10 89 15 17 ED 63 CE BD B6 39 62 C2 E1 5E B3 17 14 05 05 9E 51 30 65 09 C1 ED 2F 21 02 BA E0 FB 43 D5 85 67 77 30 A5 D7 08 D6 20 59 A9 F1 27 0C 03 46 5A 3D 16 B5 D2 02 F1 66 40 74 86 CD 09 99 08 B1 B9 65 91 76 84 BA 9A 34 7B AF 0B FC F3 7F E4 94 13 07 97 91 AC 48 A8 51 26 FB 63 4D B5 0C DB F1 6F 68 D9 A8 86 B3 F0 D9 D6 44 89 99 5F 27 4F 32 67 F5 64
URLs

http://obzuqvr5424kkc4unbq2p2i67ny3zngce3tbdr37nicjqesgqcgomfqd.onion/?ST1GHJLMOPR

https://yip.su/2QstD5

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 27 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f46d1ec2c56550f33b4f30f7f0763503b5a59e0004666de62c9483a0b4dfcac7.exe
    "C:\Users\Admin\AppData\Local\Temp\f46d1ec2c56550f33b4f30f7f0763503b5a59e0004666de62c9483a0b4dfcac7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Users\Admin\AppData\Local\Temp\f46d1ec2c56550f33b4f30f7f0763503b5a59e0004666de62c9483a0b4dfcac7.exe
      "{path}"
      2⤵
        PID:4768
      • C:\Users\Admin\AppData\Local\Temp\f46d1ec2c56550f33b4f30f7f0763503b5a59e0004666de62c9483a0b4dfcac7.exe
        "{path}"
        2⤵
          PID:332
        • C:\Users\Admin\AppData\Local\Temp\f46d1ec2c56550f33b4f30f7f0763503b5a59e0004666de62c9483a0b4dfcac7.exe
          "{path}"
          2⤵
          • Modifies extensions of user files
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Drops file in Program Files directory
          PID:4100

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/332-138-0x0000000000000000-mapping.dmp

        Download

      • memory/2200-132-0x00000000008F0000-0x00000000009C2000-memory.dmp

        Filesize

        840KB

        Download

      • memory/2200-133-0x0000000005940000-0x0000000005EE4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/2200-134-0x0000000005390000-0x0000000005422000-memory.dmp

        Filesize

        584KB

        Download

      • memory/2200-135-0x0000000005430000-0x00000000054CC000-memory.dmp

        Filesize

        624KB

        Download

      • memory/2200-136-0x0000000005360000-0x000000000536A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4100-140-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4100-139-0x0000000000000000-mapping.dmp

        Download

      • memory/4100-142-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4100-143-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4100-144-0x0000000000400000-0x000000000040E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/4768-137-0x0000000000000000-mapping.dmp

        Download