Overview

overview

10

Static

static

3

2025-01-24...er.exe

windows7-x64

10

2025-01-24...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-01-2025 09:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe

  • Size

    53KB

  • MD5

    18c0bbe2020986f0caebe8cab902c35a

  • SHA1

    999fe0fa4b1081f159583a2fdea1084d7b433399

  • SHA256

    61aa6f87fbfa2ff363d759f5a93c34097cab6451b63f696c4a9facc24be64555

  • SHA512

    72abddfa8722c5a1d87cfb7e8cb99916cb62d5ebd5886ff00a2ace601c6d6b057080668d006fc15f7ec72bccafd167e01df7d823921cd5e658946ededaefa032

  • SSDEEP

    768:927vuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5VstFGM2:9weytM3alnawrRIwxVSHMweio3st

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\[ ReStore Files ].html

Ransom Note
<html> <style type="text/css"> body { background-color: #800000; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO RESTORE YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your ID</h3></div> <div class="identi"> <pre>��������19 35 41 BE 32 75 62 09 D2 37 DB B1 D2 C9 73 3D 0B A5 CC C3 93 C4 FC F1 D4 95 74 E1 92 B1 25 36 7F 12 30 BB 15 30 C8 62 17 6D 32 92 FF 99 1B 4B 1A 1B DF 62 57 67 76 AF 49 A5 CE EA F3 03 34 51 9E 9B 90 E4 5D AB 54 0E 19 75 83 7E 42 02 A0 01 D1 CE 00 52 AB 6E 36 94 B4 2D 83 76 1E 68 B9 9A B7 EE 8A F3 6A 2B EF 87 75 E8 76 8E 77 CD 47 7F 3B B3 91 C2 26 3B 59 14 BD 92 CE BD C0 0F B1 CD D2 AB 60 2F AB E0 56 F4 A5 82 B2 B6 FB 65 10 0D D4 60 1C 98 DD 82 CF 8C A0 87 56 57 73 9A DB 35 C6 FE 4E 79 02 BA B5 5B 61 24 B2 F7 FF 22 CB C5 2E C6 F9 D4 10 7F 3F 06 2B FF A7 55 7A C2 D2 24 BF D2 F8 14 E5 6C 72 7D 2B F2 1A 12 C5 18 44 69 8F 1C 50 7C 53 10 3A 19 50 B6 F9 F8 B0 BB B1 29 97 0E F9 91 54 AB 0A 82 B4 69 9C DE 08 E4 C3 E5 FE FA EE 65 98 AC 8F 00 B5 DC 32 19 71 7A E8 B4 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 image file or text file for test <h3> [email protected] or [email protected]</h3>.</br> In the letter include your ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center><h3>Attention!</h3></center></br> <ul> <li>Only [email protected] or [email protected] can decrypt your files</li> <li>Do not trust anyone [email protected] or [email protected]</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �������������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (9074) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 30 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-01-24_18c0bbe2020986f0caebe8cab902c35a_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3350944739-639801879-157714471-1000\desktop.ini
    Filesize

    1KB

    MD5

    919f72db78c50e340bb4ced94e870a41

    SHA1

    92b2b38d6482b93c531efe92fe670aa3c96ca946

    SHA256

    01812698a27fab1728d954d580f251a072ac3dc85eb98a61b34e52500614484d

    SHA512

    df7ce5f01f6ba721947037991175cc4febe56a8df82df38a486a7e7535c3f7157737b8685ece745b2c2f2584b7fae6a9c5d43c612acdf27a5197236ebec2e875

    Download Submit

  • C:\Users\Public\Videos\[ ReStore Files ].html
    Filesize

    4KB

    MD5

    c586a89f1412b0064690257ec8ae86e2

    SHA1

    646ca9dc4918977df6327d5987b45e2dec76019c

    SHA256

    b50c0f854448b23b40bd88fe2b2fd00a4981efd14edf5fac8fab61d063629ad4

    SHA512

    a87c6e059542dcdb490cc628a862e09ebfb4a16116fdd6cce5c34a92e173b4ac9ac5420161b577a1fe44373e8c4dc44debbf9c74aad52b563ec0d4462b9e0aaa

    Download Submit

  • memory/4852-0-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download

  • memory/4852-1716-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download