Overview

overview

10

Static

static

3

2025-01-23...er.exe

windows7-x64

10

2025-01-23...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2025 13:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-23_24bc5578c1d10d0942ce19b05143e6de_globeimposter.exe

  • Size

    55KB

  • MD5

    24bc5578c1d10d0942ce19b05143e6de

  • SHA1

    9db2d43d5b39adb24544e96b5929a9d27dd340f8

  • SHA256

    3f4ddf731036dc41485bdc01e82c94bf77dfbf0180cb000e3c35e9ebf80223ef

  • SHA512

    f6546f3f018c8d476888d4b57b7d58e3dbe9b2ce716551aae40cea438e652debdc0ffaf44b70aec2cc4034d5774b0ccbf7a73667cd7161752bddca2fb314d622

  • SSDEEP

    1536:bOePKs+Na3IGeKJolntwr7DSTWvTwhQ8Yiolyx0:bOePKs+Na3IrKJolntGDT5XtC0

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text"> <!--text data --> <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> [email protected] </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>��������75 3D B9 7F B3 80 4F C9 50 83 59 95 CC B5 4A 7E F4 F5 FE 41 25 A1 5A AD A2 BE 94 4B E3 CB F4 90 00 64 38 5A 3C 81 70 58 5F 08 E5 2A 81 25 7B 8B 12 EF BF F2 25 81 5C C3 7C 00 FB FB F6 24 5B 8F 89 CA EB 5B E8 DC 84 DF 67 83 2A B4 C3 63 5A 8F 14 4B EA 26 D7 5C 7C 77 28 DD 62 46 B2 C5 F6 F3 45 29 85 FF 09 7A FF CD 45 B0 20 74 41 C2 26 F9 07 C2 2A 44 13 03 45 94 39 F9 30 24 3B CA 36 2E 9A E4 28 DA BC 77 C4 20 D1 05 A5 89 CB 80 36 23 BA 31 F6 9B 5D DF 02 66 9B 0A 0C 46 80 9B 6D 59 A1 84 66 4A A7 FE 55 15 7E F8 E1 34 EE 8F 97 4C 13 BC A3 67 85 8E 06 FB 5A FC 4C 38 22 F8 FB EA 57 E6 8F C2 8E 8D 20 63 AA 16 2D 95 BD A2 9F FA DE F2 97 57 13 B7 15 C8 F3 63 20 A2 AC 42 BE F8 0E 7D ED 11 1A 9D 9A F6 94 ED 3A 62 15 91 63 0E 9D 2D 39 BD F2 D2 54 AB 70 FF 25 92 A5 20 36 46 </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li></ul> <!--text data --> </div> </div> </div> </body> </html>���������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (9108) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 30 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-23_24bc5578c1d10d0942ce19b05143e6de_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-23_24bc5578c1d10d0942ce19b05143e6de_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2588
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-01-23_24bc5578c1d10d0942ce19b05143e6de_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini
    Filesize

    1KB

    MD5

    a16b51bc990d7a984ab1b4cebe075376

    SHA1

    6bdf48ab0281e7a0e2228c46090e0e518d4bfc9c

    SHA256

    13a2c78930c47d49f05e896e8708aedfc588639868afa694d7320a92c2778952

    SHA512

    c88656d09385fe2dfbee3c2111b5e8966be64afdc1a34b05ceaf9e849cc2e3adf746c9e1c0e5b1a8e4934cf7e53128f129a1981afa4e29108bc2f5cb170a76ea

    Download Submit

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    4KB

    MD5

    b2627de825577f061b6362769a9dc536

    SHA1

    42a2741c8d5b4727165f02096f1823eaebc8ab91

    SHA256

    23aa695e4a47194b28ba7a8f83dcce48ed115a61be9dbf5cac79a666b06032d2

    SHA512

    ab6207bfcaa462c4a20ceff33797492165e123a6235fbd438467d95fcd688972c6a586090842e3c271d66886959e415c44b887339145f9588c5de68a9f6aa5f1

    Download Submit

  • memory/2588-0-0x0000000000400000-0x000000000040EA00-memory.dmp

    Filesize

    58KB

    Download

  • memory/2588-843-0x0000000000400000-0x000000000040EA00-memory.dmp

    Filesize

    58KB

    Download