globeimposter | 13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920

General

Target

2017-11-30-GlobeImposter.exe
Size

167KB
MD5

612974dcb49adef982d9ad8d9cbdde36
SHA1

b817e361bd0cc1819d7f6a1189f0f5d56ed48721
SHA256

13e164380585fe44ac56ed10bd1ed5e42873a85040aee8c40d7596fc05f28920
SHA512

84d5acbb8f258683bb6735539e368c2823218d2a6cf07222a50e1e026e3a0aca092941110e87b1d38a601c6a1e3d54604c2f4241c3ec265ed0bf25140a14c2fc
SSDEEP

3072:Vzm96ax+qLT5+IqRRztaWEmJLhSpTGqbay/0TwEz:VS96axL5kxHP0hmy/4z

Score

10^/10

globeimposter persistence ransomware spyware stealer

Malware Config

Signatures

GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

2017-11-30-GlobeImposter.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\CompareRegister.png => C:\Users\Admin\Pictures\CompareRegister.png..doc	2017-11-30-GlobeImposter.exe
File renamed	C:\Users\Admin\Pictures\SyncSave.tif => C:\Users\Admin\Pictures\SyncSave.tif..doc	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Pictures\AssertGrant.tiff	2017-11-30-GlobeImposter.exe
File renamed	C:\Users\Admin\Pictures\CompressUnprotect.raw => C:\Users\Admin\Pictures\CompressUnprotect.raw..doc	2017-11-30-GlobeImposter.exe
File renamed	C:\Users\Admin\Pictures\RestartDeny.crw => C:\Users\Admin\Pictures\RestartDeny.crw..doc	2017-11-30-GlobeImposter.exe
File renamed	C:\Users\Admin\Pictures\StopGrant.tif => C:\Users\Admin\Pictures\StopGrant.tif..doc	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Pictures\WatchTest.tiff	2017-11-30-GlobeImposter.exe
File renamed	C:\Users\Admin\Pictures\WatchTest.tiff => C:\Users\Admin\Pictures\WatchTest.tiff..doc	2017-11-30-GlobeImposter.exe
File renamed	C:\Users\Admin\Pictures\AssertGrant.tiff => C:\Users\Admin\Pictures\AssertGrant.tiff..doc	2017-11-30-GlobeImposter.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

2017-11-30-GlobeImposter.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Roaming\\2017-11-30-GlobeImposter.exe"	2017-11-30-GlobeImposter.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	2017-11-30-GlobeImposter.exe

Drops desktop.ini file(s) 29 IoCs

Processes:

2017-11-30-GlobeImposter.exe

description	ioc	process
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	2017-11-30-GlobeImposter.exe

Drops file in Program Files directory 64 IoCs

Processes:

2017-11-30-GlobeImposter.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382967.JPG	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\StarterApplicationDescriptors.xml	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\ACTIVITS.ICO	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECURS.ICO	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18225_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04117_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07761_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341475.JPG	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSansBold.ttf	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.VN.XML	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SHARING.CFG	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15072_.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21302_.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Pushpin.xml	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03205I.JPG	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\UrbanMergeFax.Dotx	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCOUPON.DPV	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREET11.POC	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileHigh.jpg	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTL.ICO	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH.HXS	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15170_.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18189_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0217302.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21328_.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Waveform.eftx	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00096_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00296_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_es.dll	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BZCARD11.POC	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151067.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_a52_plugin.dll	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSTINTL.DLL	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msolap100.dll	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libpuzzle_plugin.dll	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OFFOWC.DLL	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME04.CSS	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00163_.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196364.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.Interop.InfoPath.SemiTrust.dll	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME28.CSS	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME31.CSS	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00563_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files\Windows Journal\it-IT\jnwmon.dll.mui	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIcons.jpg	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107288.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01244_.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MORPH9.DLL	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.DPV	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImages.jpg	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT_K_COL.HXK	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14832_.GIF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN03500_.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152690.WMF	2017-11-30-GlobeImposter.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02293_.WMF	2017-11-30-GlobeImposter.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

2017-11-30-GlobeImposter.exe

pid process

1736 2017-11-30-GlobeImposter.exe

pid	process
1736	2017-11-30-GlobeImposter.exe

C:\Users\Admin\AppData\Local\Temp\2017-11-30-GlobeImposter.exe
"C:\Users\Admin\AppData\Local\Temp\2017-11-30-GlobeImposter.exe"
1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1736

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Videos\Sample Videos\Read___ME.html
Filesize
4KB

MD5
2c7817b23b1fed7e1051b68a967cef3a

SHA1
6ae5f281c0ec8e7b8211624a04463134b47e4226

SHA256
ebf75d1c6935a2ad6d3f1390c6a6cc783557e611e1ede1c075d6de7fdb9ddf5d

SHA512
6d641d10dbe1b9567e1808ab7e0cc2c59e0860ca6e62fa8efce3128b8f290899113441b1c3673eff37b89dda3f0bccd38641e91730aa507ce1286f3af21e3df1

Download Submit
memory/1736-699-0x0000000000400000-0x0000000000530000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads