Overview

overview

10

Static

static

3

2025-01-29...er.exe

windows7-x64

10

2025-01-29...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-01-2025 08:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-01-29_3accf293ba124515006a6772cb88566f_globeimposter.exe

  • Size

    53KB

  • MD5

    3accf293ba124515006a6772cb88566f

  • SHA1

    313f083bd613e8a017e5c2471edacdae7f758752

  • SHA256

    f43e246f70fca07d2c3ea432e12c549ed94cd750ee407a27cd34dffa47aec8b1

  • SHA512

    7270a58555ecb0a27e5385e7a0dce39f1ff315d45e90c7bbe9219fec09c8b211fa5f68b7591e016a7940af1b9861ba159c6b86cbd80031a1ad70eb43449a5dfd

  • SSDEEP

    768:+5Lvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5IQhH:CeytM3alnawrRIwxVSHMweio3yQ1

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (9138) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 30 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-29_3accf293ba124515006a6772cb88566f_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-29_3accf293ba124515006a6772cb88566f_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3928
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-01-29_3accf293ba124515006a6772cb88566f_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini
    Filesize

    1KB

    MD5

    de43b7f3b75ae05fe8bf7e93ff33ad49

    SHA1

    1e53f2de0d71860bbdf7ba20c5952b2adf14e3e4

    SHA256

    bcc5d64bad3d8ee8d9947490b71120156a156892a526cbc70c2279cc34740799

    SHA512

    d3c15965755a3f16571cfe4cec8b217775076a73600b2acc9b76c6cea5162a35609f0b17b0520cb6f69976741517c19783788f03b3af82cfad68e4384f54a326

    Download Submit

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    4KB

    MD5

    b199cfb3ba6786ba5e46b0a980bbd2fa

    SHA1

    46e3f798a004b04f579a98e131f80a4ee707c510

    SHA256

    70ebb7b296cda659ae33367e3c572293e11db71da1ba7aa39caae246dc73052b

    SHA512

    a7d926660e950a22e94831b6b451eb0e459cb8a92e60699f0d7dbef1f2af2598e3080bbb008e4fe136117a440050b60b9a26b3826444c969d78ad29ba493c64e

    Download Submit

  • memory/3928-0-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download

  • memory/3928-1793-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download