Overview

overview

10

Static

static

418a45b6d7...79.exe

windows7-x64

10

418a45b6d7...79.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    169s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2023 18:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579.exe

  • Size

    366KB

  • MD5

    dd065e54805dfc8c1640065803a3fa23

  • SHA1

    e0e3646919b6fdb37fd9d9d70d3c0ef23d46dc1a

  • SHA256

    418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579

  • SHA512

    5f7885acfa03411e743579b537257b68aec67e08babcf035689338663f27be082307e65adced4a7f94a413f44a141b5670872d1791b728d4ef6fb592a2b958b0

  • SSDEEP

    6144:W8afWfuCiCEfwdciYYx8+W5p56UKV4UszE7hvriQi:W6ueEMPvW8UhUszE7hvDi

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Restore-My-Files.txt

Ransom Note
All your files are Encrypted! For data recovery needs decryptor. How to buy decryptor: ---------------------------------------------------------------------------------------- | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://decrmbgpvh6kvmti.onion/ | 3. Follow the instructions on this page ---------------------------------------------------------------------------------------- Note! This link is available via "Tor Browser" only. ------------------------------------------------------------ Free decryption as guarantee. Before paying you can send us 1 file for free decryption. ------------------------------------------------------------ alternate address - http://helpinfh6vj47ift.onion/ DO NOT CHANGE DATA BELOW ###s6dlsnhtjwbhr###�����������73 91 FE C6 61 D8 DB A6 4E 0E 77 08 D1 D8 E3 E2 AE 9E 8A 1A 12 A2 E0 F2 F1 30 43 BB 8D A3 C4 94 5C 2B E6 1D 3F C6 16 23 E5 F2 D1 F0 41 10 3C 42 1F 86 F7 3E E5 8B 30 CB FE 0E 3D CC F7 A0 1A A3 94 25 B0 28 E8 CD 35 33 79 4A AD A3 8B B5 2A 59 51 36 D2 01 9C 4A BB 5C 52 41 A6 76 2A CF FA 43 B0 C6 1E 87 01 CD C5 66 5A 59 13 B8 84 F0 7A 8A 59 52 6C 23 4F F0 D1 2C 64 A2 FD B1 9A 94 66 E3 2B A8 D8 5B 11 77 F2 6B 93 56 1B DB 3D 92 FB 14 A7 87 6F 44 A8 EA A7 B7 CF DF 8B AD D2 65 A7 92 22 7F AA 67 A2 21 EE 05 3E 45 2C 15 3A 56 5F A0 29 65 D3 5F 9D CD E3 89 CC EA 38 A7 0A 8A 9C 61 57 96 A8 49 F0 60 93 54 D6 72 9D 38 20 96 DF 66 9B 26 4A 9C 90 17 CD 4C 20 00 FE 9B 10 A8 9B 08 B5 D2 60 C8 EF B3 8F 57 F0 2E F2 BF FC A2 3F 10 10 0E 49 96 8A 06 C2 09 7A 0D 3F 35 B7 E0 8A D4 ###�������������
URLs

http://decrmbgpvh6kvmti.onion/

http://helpinfh6vj47ift.onion/

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Modifies extensions of user files 3 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 26 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579.exe
    "C:\Users\Admin\AppData\Local\Temp\418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Users\Admin\AppData\Local\Temp\418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579.exe
      "C:\Users\Admin\AppData\Local\Temp\418a45b6d7b2b1c9615bcc5023765b25621429bc1c45702d6f43695e101da579.exe"
      2⤵
      • Modifies extensions of user files
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Drops file in Program Files directory
      PID:5096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/952-132-0x0000000000330000-0x0000000000390000-memory.dmp
    Filesize

    384KB

    Download
  • memory/952-134-0x0000000000330000-0x0000000000390000-memory.dmp
    Filesize

    384KB

    Download
  • memory/5096-133-0x0000000000000000-mapping.dmp
    Download
  • memory/5096-135-0x0000000000400000-0x000000000040E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/5096-136-0x0000000000400000-0x000000000040E000-memory.dmp
    Filesize

    56KB

    Download