Overview

overview

10

Static

static

3

2025-01-28...er.exe

windows7-x64

10

2025-01-28...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2025, 16:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter.exe

  • Size

    53KB

  • MD5

    37b9d85115a8883aef54efdb2d1b9feb

  • SHA1

    b10523a4db8a65364fac0e96784337fc77a4c74c

  • SHA256

    b8f9df31f5f358069fd8c9c2288384e5fedc6db93b52f54c8f96e7dd48c22346

  • SHA512

    2751f037a2ff3bd0ab85941e4ce83cd79aab925df04c291451647a5f09461d20cc42bb1d3dd922109b83b056dc3fb7079648f4e018d73d256d7d5184149e4310

  • SSDEEP

    1536:WGSPKs+Na3IGeKJolntwr7DSTWvTwhQ8YiodI:zSPKs+Na3IrKJolntGDT5XtdI

Score
10/10
globeimposterpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <head> <meta charset="utf-8"> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background-color: #C1AB8F; } .bold { font-weight: bold; } .xx { border: 1px dashed #000; background: #E3D5F1; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { font-size: 30px; height: 50px; line-height: 50px; font-weight: bold; border-bottom: 10px solid #D0D0E8; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } </style> </head> <body> <div class="header">Attention! All your files are encrypted.</div> <div class="note alert"> <ul><li>Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software - "YASUDA DECRYPTOR" Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.</li> <li>If you want to restore files, write us to the e-mail: [email protected] In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)</li> <li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> </ul> </div> <div class="note private"> <div class="title">Your personal ID</div> <pre>���������������1C 8E 64 D4 38 83 42 35 83 6B 2D B4 2E 07 6F 65 63 94 9D 7B 79 BE 9A CC 3C 75 1A D6 66 15 29 0B F0 23 70 77 5B 02 55 E5 0C CF 6B 89 B3 E8 F2 1C F5 F3 D6 F6 82 73 68 AD 61 83 BA D8 EF 82 19 D1 EF BB 63 FC 58 6B F0 62 ED 5B FE 91 AC 63 B0 87 C7 66 C0 3A B8 3D 2F 54 B2 9C D6 7C E7 AE E1 53 54 4F 91 31 B4 26 74 DF 24 B3 6B 97 69 50 D8 9A 56 55 A8 16 B9 3C 4E 11 B8 F8 38 38 BA CD 40 A9 43 EE 8C DB 7B 99 D9 D4 AD E5 F7 01 56 78 B5 30 18 24 54 31 8E A5 25 2C 13 6A D7 A6 32 E2 31 7A 31 CA E5 42 16 3A 96 A0 09 C4 54 77 A0 68 E4 58 E0 0A 46 B9 29 41 7B 99 72 9E CE AA 00 68 EF A4 0B CF 9A 86 DC EC 21 F9 D9 9C 92 2A A0 AD 2B 9F 94 17 32 6B B3 42 03 0E 3E F8 4F 31 B2 C9 76 8E 94 75 2D 31 2A 03 2A B6 FB E3 0B AA A0 99 EA C2 31 46 D8 81 A2 E0 AA 92 CF 5B 97 04 10 57 06 EE </pre> </div> </body> </html>��������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (7497) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 37 IoCs
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    PID:1716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    3KB

    MD5

    de7dba2fcf2ce2bbfb522b741f494704

    SHA1

    3c013f75634c779be2e1e0fbb6fc0ffda3a3a484

    SHA256

    eaabf0e31f08d867a5f621ee13b196af77e2d6d83679bc7ab954a2116006eb67

    SHA512

    d65a9a01566084a81ea89e93c96341854c2089dcfab8d3971a074182a1f07d9227440ed1ad22e7827729bf1823ebdbcde6a3145ee563a20b6dcce5bb57ddb746

    Download Submit

  • memory/1716-0-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download

  • memory/1716-662-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download