globeimposter | 1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539

General

Target

1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
Size

53KB
MD5

7791c18c9d4a94d80a7928644937c070
SHA1

41fca79af1747a862864d2c9114648d6f5404bed
SHA256

1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539
SHA512

81043a21b0e0588b3594210b2339c656d994b72b2787da68a5f433992e054c2bec961e4403997ec846f38862c15a1ff6c5f9faece1b122e838baec759e14f012
SSDEEP

768:XZvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5VmXOt:XZeytM3alnawrRIwxVSHMweio3xt

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\DebugGet.crw => C:\Users\Admin\Pictures\DebugGet.crw.sickfile	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File renamed	C:\Users\Admin\Pictures\PingInvoke.crw => C:\Users\Admin\Pictures\PingInvoke.crw.sickfile	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File renamed	C:\Users\Admin\Pictures\StartInstall.crw => C:\Users\Admin\Pictures\StartInstall.crw.sickfile	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File renamed	C:\Users\Admin\Pictures\UndoSync.crw => C:\Users\Admin\Pictures\UndoSync.crw.sickfile	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

968 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
968	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe"	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe

Drops file in Program Files directory 64 IoCs

Processes:

1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00257_.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Dawson	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host-views.xml	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099204.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01255G.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File created	C:\Program Files\Microsoft Games\Purble Place\fr-FR\how_to_back_files.html	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+11	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10308_.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15301_.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\RPLBRF35.CHM	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0172035.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Microsoft Games\Chess\ChessMCE.png	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\Whistling.wav	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090390.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveLetter.dotx	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301418.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\how_to_back_files.html	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\feature.xml	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR51B.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15132_.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00345_.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\how_to_back_files.html	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-progress.xml	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\localedata.jar	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Address.accft	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3B.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME13.CSS	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets_1.0.0.v20140514-1823.jar	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_COL.HXC	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\LAUNCH.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Windows Journal\Templates\Music.jtp	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Atlantic\Azores	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR24F.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR36B.GIF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN092.XML	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETSM.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\how_to_back_files.html	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_hyperlink.gif	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199283.WMF	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.rst	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ja-JP\chkrzm.exe.mui	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Ho_Chi_Minh	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe

description	pid	process	target process
PID 1896 wrote to memory of 968	1896	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe	cmd.exe
PID 1896 wrote to memory of 968	1896	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe	cmd.exe
PID 1896 wrote to memory of 968	1896	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe	cmd.exe
PID 1896 wrote to memory of 968	1896	1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe
"C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1c2d5cccca58b469351980895c8a2080c8346de09c2f1ab7a123deb3d3e4a539.exe > nul
  2⤵
  - Deletes itself
  PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-56-0x0000000000000000-mapping.dmp

Download
memory/1896-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1896-55-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads