globeimposter | d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e

General

Target
d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
Size 55KB
Sample230108-pmn2jade69
SHA256 d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e
MD5 6af267d388242b54a87d0d0b6eb0ccd8
SHA1 eeeec084ebf73ca9d6600452e2997a469b4996c9
SHA512 270e9ee5ec4fd63045a8e6a704106e178bd20788b73e7e1a9e4db83eaa629b38dd55bf7a202d534c0d91a20ce76e7b21d14335f94366f4acbf8a20194cfadce2
SSDEEP 768:emtihjk9hlg4tBLuZuZJHe4ndXxnWlHznD/VwrEQYtqVi6S9JWvZ/KWwhQMNzLm9:eTjkfV+KJolntwrbDSTWvTwhQMhmpdL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��43 F3 51 D7 6A 9A FE B3 59 6E 7D 5E 35 CB 7A 40 F9 D1 5D 03 0E 1F C0 30 60 5D 9B 44 E8 7E DB 04 6A 53 96 E9 0C DE AB CE D0 3B 05 AF AA 77 64 4A 57 BD 0A 4F F2 71 BD 96 BA 22 CC 0C 24 07 C7 8B F3 12 AC C2 37 70 1D 6D 41 21 2D F9 0B 4C D2 46 74 CC 50 3B 8F E3 2D 25 98 F3 2C 3F 8D 27 D9 15 42 8C 01 33 7C F7 B4 C6 AF 19 C4 B7 7B EC 96 4C 26 1F 52 35 88 8F 8B 1A 04 4E AF 6B 3C 14 05 82 CB 73 18 FE 7A 75 03 0C 44 AB EC 3E E0 3E BA E2 B0 8B E6 5F A0 3D D5 55 81 CB 68 5B 91 4A 2E 4E FB 4C CB E0 AD E2 D8 FD 3D 52 FB 4B 41 F4 02 10 14 BC F6 22 50 B2 F4 5D 4A BD FE D0 3E AE 83 41 A3 97 A7 73 BE D5 19 8D E4 3F 17 E1 69 B2 4B A8 86 4B 6D 05 03 CB 70 4B CF B6 C0 2A 81 C6 B2 A5 E0 EF ED 7B CB DC F1 B2 B3 64 2E 8E A6 5A 23 E4 DF C9 50 78 30 27 52 2B D2 AC D2 29 81 51 87 60 </p> </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>☣ Your files are encrypted! ☣</h1> <hr/> <h3> &#11015 To decrypt, follow the instructions below. &#11015 </h3> <br/> <div class="text">  To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul>  </div> </div> </div>  </ul>  </div> </div>  </div> </div> </body> </html>

Emails

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 10 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\DismountCompare.png => C:\Users\Admin\Pictures\DismountCompare.png.CHAK2	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Pictures\ExpandExport.tiff	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File renamed	C:\Users\Admin\Pictures\ExpandExport.tiff => C:\Users\Admin\Pictures\ExpandExport.tiff.CHAK2	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Pictures\LimitGrant.tiff	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File renamed	C:\Users\Admin\Pictures\UninstallCheckpoint.raw => C:\Users\Admin\Pictures\UninstallCheckpoint.raw.CHAK2	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File renamed	C:\Users\Admin\Pictures\InvokeGet.crw => C:\Users\Admin\Pictures\InvokeGet.crw.CHAK2	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File renamed	C:\Users\Admin\Pictures\LimitGrant.tiff => C:\Users\Admin\Pictures\LimitGrant.tiff.CHAK2	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File renamed	C:\Users\Admin\Pictures\MoveSync.tif => C:\Users\Admin\Pictures\MoveSync.tif.CHAK2	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Pictures\ResetOut.tiff	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File renamed	C:\Users\Admin\Pictures\ResetOut.tiff => C:\Users\Admin\Pictures\ResetOut.tiff.CHAK2	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe"	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe

Drops desktop.ini file(s) 24 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe

C:\Users\Admin\AppData\Local\Temp\d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe
"C:\Users\Admin\AppData\Local\Temp\d16518abb5dc4d76f4f423d02b0b8c99fe5edb89edf3c60ca64ebb2a6879a15e.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
PID:2988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2988-132-0x0000000000400000-0x000000000040EC00-memory.dmp

Download

Analysis

Sharing