Overview

overview

10

Static

static

3

2025-01-28...er.exe

windows7-x64

10

2025-01-28...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2025 16:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter.exe

  • Size

    53KB

  • MD5

    37b9d85115a8883aef54efdb2d1b9feb

  • SHA1

    b10523a4db8a65364fac0e96784337fc77a4c74c

  • SHA256

    b8f9df31f5f358069fd8c9c2288384e5fedc6db93b52f54c8f96e7dd48c22346

  • SHA512

    2751f037a2ff3bd0ab85941e4ce83cd79aab925df04c291451647a5f09461d20cc42bb1d3dd922109b83b056dc3fb7079648f4e018d73d256d7d5184149e4310

  • SSDEEP

    1536:WGSPKs+Na3IGeKJolntwr7DSTWvTwhQ8YiodI:zSPKs+Na3IrKJolntGDT5XtdI

Score
10/10
globeimposterdiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <head> <meta charset="utf-8"> <style type="text/css"> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background-color: #C1AB8F; } .bold { font-weight: bold; } .xx { border: 1px dashed #000; background: #E3D5F1; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { font-size: 30px; height: 50px; line-height: 50px; font-weight: bold; border-bottom: 10px solid #D0D0E8; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } </style> </head> <body> <div class="header">Attention! All your files are encrypted.</div> <div class="note alert"> <ul><li>Your documents, photos, databases and other important files have been encrypted cryptographically strong, without the original key recovery is impossible! To decrypt your files you need to buy the special software - "YASUDA DECRYPTOR" Using another tools could corrupt your files, in case of using third party software we dont give guarantees that full recovery is possible so use it on your own risk.</li> <li>If you want to restore files, write us to the e-mail: [email protected] In subject line write "encryption" and attach your personal ID in body of your message also attach to email 3 crypted files. (files have to be less than 10 MB)</li> <li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> </ul> </div> <div class="note private"> <div class="title">Your personal ID</div> <pre>���������������35 FF 26 8E 5B E8 AD 12 8F 8E C2 85 DB 6E 26 94 FD 33 72 14 74 39 D6 2A FE D7 C8 3D FC A9 58 86 6D BA 59 C4 94 A5 2B 10 9B 21 79 37 9A E9 FE 29 F9 70 6D 42 74 CF 6D DD 84 C7 F0 58 91 E2 5C 91 52 FB 89 F9 CB 17 E0 CE A2 A1 24 FF 43 0D 49 CB 5C DB 6D F6 85 D4 5D C5 6A 1D 75 66 42 1F E3 75 00 15 B2 C3 09 F2 F4 18 13 79 AE B1 13 02 40 A1 A7 56 82 F8 71 C5 FC 9C EF B0 EE CD E5 83 55 02 0C 78 7D 5D 36 5C 21 2C 60 AE 8B 54 5D 07 2F 67 01 58 2E AF 77 AF DA 4B BA EB 8B CF E7 8A BE 8E 27 D4 B8 90 54 33 56 51 4B A0 C9 E9 1F 74 9E 82 7F 7F 46 23 EE 36 40 62 74 10 8A AE 92 6D 8C FD CD CD F5 89 38 5F F0 94 A1 6C E4 37 F4 CD 7D 89 3C 3C 3F 77 69 EC 0E 2A CE 64 F9 F2 E9 40 F3 93 6D 74 60 68 83 DB 0C 9C 3D E4 EA B4 76 35 E8 D8 48 55 8A 99 98 DC EF 14 D8 46 12 F1 10 BA DD 1B </pre> </div> </body> </html>��������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8614) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 29 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-28_37b9d85115a8883aef54efdb2d1b9feb_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    PID:1852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    3KB

    MD5

    68d14e434d070fe963fd053c31007c44

    SHA1

    1de2f53c2f33de96db0255ad2c5e3fc3ce40164d

    SHA256

    f9344c7158101e453759204eb5bffe642dd802bb75b453185c03b70731962ae7

    SHA512

    f3af76534e2aa494fa1668ea5c928cf4bdcc0384c414a7481ce18936237423b4be1f7d0d984ecc82457dda4cc3d7eef692d97085c442c352bcb55f6c0d4bc227

    Download Submit

  • memory/1852-0-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download

  • memory/1852-795-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download