Overview

overview

10

Static

static

3

2025-02-13...er.exe

windows7-x64

10

2025-02-13...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    110s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2025, 08:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-02-13_700edcce509ddcb71a31d1b3765004c2_globeimposter.exe

  • Size

    50KB

  • MD5

    700edcce509ddcb71a31d1b3765004c2

  • SHA1

    0a19d5d16d772853e0ae32d8ccf09454b51bbfc2

  • SHA256

    1ad20ff4f0ba0af89d3af59c4e9d6015df5b4ee90472f576a4dd578c5bff4c84

  • SHA512

    12558b1c47813b3049e99e80e0649b9aa7ab0eec8796f965969fb9b30d742e68e9b3915a8a209e3cc53e8a7ad1bee27e342115b4f3c89aa26f0025df2bbaf03f

  • SSDEEP

    768:fqAFvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5uF:zeytM3alnawrRIwxVSHMweio3

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (9128) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 30 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-02-13_700edcce509ddcb71a31d1b3765004c2_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-02-13_700edcce509ddcb71a31d1b3765004c2_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3640
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-02-13_700edcce509ddcb71a31d1b3765004c2_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:224
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEFBRjBFQTgtMzg4MC00NkRGLUIyNTktNjJFREEwRjI4NUU3fSIgdXNlcmlkPSJ7QjU3RTYwOUYtNzMwRC00ODQ5LTlGMTEtRjM4NUUyNUNBNDJDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QjIxOEJFMzctRUQwQS00QzcxLUEwOEMtQ0FFNjFCRjhGRjdEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY0MzMiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODc1OTU2NTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTk3NTk4MDE2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3932017190-1449707826-1445630-1000\desktop.ini
    Filesize

    1KB

    MD5

    1cf990c937e5cac2dcc760c547274e8b

    SHA1

    36c7be15fd17c5357046ada0058d12158f434b28

    SHA256

    560e731fd2ba99af34ba993a54a0da1e35eaf4be71989998d70ffc220487b080

    SHA512

    b2ac9f0307fe89bd581f46ad22bbb6ba4faf16fa25546bc06bd7af6cbe2e2390b751c00b9fd08a166763d19ad8f7c3d5e53b92d07193816d9f25214253d81678

    Download Submit

  • C:\Users\Public\Pictures\README.TXT
    Filesize

    1KB

    MD5

    a4321f092ea3b6d16ed1f052caa23fbe

    SHA1

    6ac3e6ce4b1dc648b025e213fd85495e49c944d0

    SHA256

    d8fe54c39928fc70478f9b095316f9e4bc4e66b45f866ee5c0799f6747f81122

    SHA512

    f49f58296f0868d58c9200914755724b786673211e0e8bc916b262e92ec3a0f922aafd04581e27cdd4b7a5129a6fbb01de6dcc7474f77fa539aad26b0e732f29

    Download Submit

  • memory/3640-0-0x0000000000400000-0x000000000040D400-memory.dmp

    Filesize

    53KB

    Download

  • memory/3640-1583-0x0000000000400000-0x000000000040D400-memory.dmp

    Filesize

    53KB

    Download