Overview

overview

10

Static

static

3

2024-08-09...er.exe

windows7-x64

10

2024-08-09...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    47s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09/08/2024, 23:42 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe

  • Size

    53KB

  • MD5

    d6d78dd3190e9b80975ed8e281bd4d60

  • SHA1

    96934ee9d9d8fe3b531331fe1fc578e66591304b

  • SHA256

    204999f72452d3245497aca2e878dde751eff81cf11ceb7d8d17cc6cf8dc03d4

  • SHA512

    c4e6b3846b3724f7728c971421bfe336b69737289126dcdcb255b0515eb56ec2735f3e47bb8e19743e0681552d6c3002ff266c683079c73c0aa54598e004177b

  • SSDEEP

    768:3Ovuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5ZoiJ:3keytM3alnawrRIwxVSHMweio3To

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\How_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #f5f5f5; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ display: block; margin: auto; } .tabs1 .head{ text-align: center; float: top; padding: 0px; text-transform: uppercase; font-weight: normal; display: block; background: #81bef7; color: #DF0101; font-size: 30px; } .tabs1 .identi { font-size: 10px; text-align: center; float: top; padding: 15px; display: block; background: #81bef7; color: #DFDFDF; word-break: break-all; } .tabs .content { background: #f5f5f5; /*text-align: center;*/ color: #000000; padding: 25px 15px; font-size: 15px; font-weight: 400; line-height: 20px; } .tabs .content a { color: #df0130; font-size: 23px; font-style: italic; text-decoration: none; line-height: 35px; } .tabs .content .text{ padding: 25px; line-height: 1.2; } </style> <body> <div class="tabs1"> <div class="head" ><b>Your personal ID:</b></div> <div class="identi"> <span style="width:1000px; color: #ffffff; font-size: 10px;">��������������47 6C FD 94 42 14 0E D3 6D 27 06 7E F2 31 84 55 22 0E C5 43 2B D1 A7 9E 44 5F DC AB 71 DC A1 F1 C0 D7 ED 20 99 19 AC AC 48 B0 81 F9 DE 31 82 25 3B 06 FF E0 30 24 CB D2 6B 9F 79 78 D3 4F A1 6B C6 52 1A B5 F7 28 A3 83 2F 5E 91 AD 6E 0C AC 6B 6E C4 27 17 B2 B5 13 A2 7A 34 0D F2 B0 25 79 D3 B9 A1 DC 2E 67 86 30 EC 69 DC 24 3F B2 E4 A1 7D 7F E5 9A 53 7C 3A 31 95 BB 23 1E EE 6E 29 42 23 FC F1 72 BB D2 5B 36 D5 22 02 BD 53 3C 04 54 54 F5 FD 48 41 EE A8 B6 14 02 37 48 98 39 78 AB 24 71 CE B1 6A 2F D5 65 A3 1A 6F CF 57 EF 08 52 AB D5 2F BD 89 11 A1 03 D2 FD 68 A3 CE 26 75 D3 84 E6 F6 9E 24 7B 94 AA 0F 35 D6 43 02 4E 39 F5 9A 72 DE A9 BE D0 C6 1B 3E 16 52 A0 EE CC 53 B3 FC 2E 1F 4E F6 CA DF 93 F0 D7 63 06 2C FB E9 7F 89 F5 5B 65 F9 04 6B 65 84 06 51 A2 FF 25 FE 26 41 </span> <br> <!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <div id="tab-content1" class="content"> <div class="text"> <!--text data --> <b>/!\ YOUR COMPANY NETWORK HAS BEEN PENETRATED /!\</b><br> <b>All your important files have been encrypted!</b><br><br> <hr> Your files are safe! Only modified. (RSA+AES)<br><br> ANY ATTEMPT TO RESTORE YOUR FILES WITH THIRD-PARTY SOFTWARE<br> WILL PERMANENTLY CORRUPT IT.<br> DO NOT MODIFY ENCRYPTED FILES.<br> DO NOT RENAME ENCRYPTED FILES.<br><br> No software available on internet can help you. We are the only ones able to<br> solve your problem.<br><br> We gathered highly confidential/personal data. These data are currently stored on<br> a private server. This server will be immediately destroyed after your payment.<br> If you decide to not pay, we will release your data to public or re-seller.<br> So you can expect your data to be publicly available in the near future..<br><br> We only seek money and our goal is not to damage your reputation or prevent<br> your business from running.<br><br> You will can send us 2-3 non-important files and we will decrypt it for free<br> to prove we are able to give your files back.<br><br> <!--text data --> <hr> <b>Contact us for price and get decryption software.</b><br><br> <hr> <b>email:</b><br> <a href="pomocit01@kanzensei.top ">pomocit01@kanzensei.top </a> <br> <a href="pomocit01@surakshaguardian.com ">pomocit01@surakshaguardian.com </a> <br> <p>* To contact us, create a new free email account on the site: <a href="https://protonmail.com">protonmail.com <br> <b> IF YOU DON'T CONTACT US WITHIN 72 HOURS, PRICE WILL BE HIGHER.</b><br> <p>* Tor-chat to always be in touch: <a href<a href<b> </div> </div> </div> <!--tab--> <b> <b> <b> <span style="font-size: 22px">qd7pcafncosqfqu3ha6fcx4h6sr7tzwagzpcdcnytiw3b6varaeqv5yd.onion</span> </b><br><br> </b><br> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html>�������
Emails

href="pomocit01@kanzensei.top

">pomocit01@kanzensei.top

href="pomocit01@surakshaguardian.com

">pomocit01@surakshaguardian.com

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Renames multiple (7446) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2024-08-09_d6d78dd3190e9b80975ed8e281bd4d60_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini
    Filesize

    1KB

    MD5

    f9c0c2667e8ce8ffd74c89f97bb9c84f

    SHA1

    7f78bede6301005370b465af157e29c2a942d727

    SHA256

    dd5bd6bd1a77b7c85398b1f463c62ec5257f2e97ec4a36f2abd97fdd356533a0

    SHA512

    4f200dc0e0fc99ebd6e818253f1b729fd599af536eded64b6b8ca5268449e3347e2f0e525dce0ea94623e785d22e1e78cb81bb69ca1fd8c17b5e2a52f82ed303

    Download Submit

  • C:\Users\Public\Videos\How_to_back_files.html
    Filesize

    4KB

    MD5

    22d77fe8d54bd639b9ae30c198f8c8a4

    SHA1

    9425cdb68aec92403e3b4e2eb2a222210ce80762

    SHA256

    08b737be97828c9ed43e18baeadf3f101ed24614e2adb94e0f9bbc276b74ae55

    SHA512

    5b93ae3f0ee6a06afcf841964cd92bf36a9bd2f1a0622fd942a5745d5aca3846f3c8cbe97f0c5f4f3ea2e4feb767e2cf3ef5da7cfac0d6b279326aa332628e36

    Download Submit

  • memory/2524-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2524-7109-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.