Overview

overview

10

Static

static

3

2025-01-24...er.exe

windows7-x64

10

2025-01-24...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24-01-2025 09:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe

  • Size

    53KB

  • MD5

    18c0bbe2020986f0caebe8cab902c35a

  • SHA1

    999fe0fa4b1081f159583a2fdea1084d7b433399

  • SHA256

    61aa6f87fbfa2ff363d759f5a93c34097cab6451b63f696c4a9facc24be64555

  • SHA512

    72abddfa8722c5a1d87cfb7e8cb99916cb62d5ebd5886ff00a2ace601c6d6b057080668d006fc15f7ec72bccafd167e01df7d823921cd5e658946ededaefa032

  • SSDEEP

    768:927vuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5VstFGM2:9weytM3alnawrRIwxVSHMweio3st

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\[ ReStore Files ].html

Ransom Note
<html> <style type="text/css"> body { background-color: #800000; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO RESTORE YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your ID</h3></div> <div class="identi"> <pre>��������44 40 EC EF 15 9A 0A 32 34 77 FF BA 62 DC B9 D2 E2 13 FA 10 D9 47 6E 45 9F 4E 9E A3 42 90 B0 63 54 2D 73 F3 F7 03 EA 3C C0 C8 AF AA C9 12 A1 AD 8E 53 B8 88 CF CD B5 34 85 85 D8 F3 0B 35 4E 9C E6 2E 21 9E 4F 34 32 4F 06 2D 17 C1 9D 8C 62 26 19 C1 5E 2C BC 82 08 EC 19 04 02 6E 59 26 6B FB 2A 83 8E 95 27 E6 E9 5A 82 D1 CE 72 CE 1A A7 04 CC 2F EE 28 CD 47 73 43 AC 06 C1 72 6E 60 2F DC 96 0D E7 4B 4E DE 8C E3 DE CE 51 0D 14 34 5A B6 AC 72 C5 0D D5 B0 7C B3 93 F6 D9 BC 53 C5 EB DF 9B 16 B7 39 C4 9C 35 A9 38 8B FF 1D 3C FC 4C 3B E3 BC 7B 2F 4E 5C AD 00 AB 46 54 7C 17 52 FF F6 16 36 46 52 F2 01 A6 30 7C 2F 56 2B B6 DC 5A 3A C6 D9 7E AA 60 A2 63 23 D8 FB C9 A5 F3 F8 6C F7 9A 88 33 B4 90 CD FA 23 AD 83 A3 0C EB 10 0B E8 D9 9F CF EF 0E 3C 83 03 73 D7 37 8F 3A 12 4C 94 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 image file or text file for test <h3> [email protected] or [email protected]</h3>.</br> In the letter include your ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center><h3>Attention!</h3></center></br> <ul> <li>Only [email protected] or [email protected] can decrypt your files</li> <li>Do not trust anyone [email protected] or [email protected]</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �������������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8635) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2188

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini
    Filesize

    1KB

    MD5

    d27601a9bc5c8f2b05773982562aa72e

    SHA1

    060f789e99a95a62899ecc70d322470c3f432b65

    SHA256

    a1d2f7e2917d7f02dcfcc387f65a30af5904edf27d0c82b53d880741756a7a30

    SHA512

    66e2bf3ef65d033dbb85e37cd81a2094bb72aec95a611f440a7b7bca030f9e58ca680b2e31af3333eab925a8a883f15908c9078006777572bacd16d4ad831736

    Download Submit

  • C:\Users\Public\Videos\[ ReStore Files ].html
    Filesize

    4KB

    MD5

    f01ac8ded9084f494b81b4bb0c4f3235

    SHA1

    2a4f00319b7f223c90c2262067e21db628ba13b3

    SHA256

    1e4c382bf8495883241542d713353bea2f6477995dfc061755b1878122ed2d35

    SHA512

    ca8c9541712bf5724f17759e17dc12346ce8e1a955843fb2eb652bb603afd47b662c2d5565726ac495f4905da371503646a76264a4ac8346c6670d389e6307eb

    Download Submit

  • memory/2248-0-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download

  • memory/2248-1410-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download