Overview

overview

10

Static

static

3

2025-03-05...er.exe

windows7-x64

10

2025-03-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 21:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-05_71e99529c74cd2203188c802ec1b0da9_globeimposter.exe

  • Size

    53KB

  • MD5

    71e99529c74cd2203188c802ec1b0da9

  • SHA1

    f0bc068e483f703308e5af56aa41060896893381

  • SHA256

    3a42c34671b164812ebbb2a299f14ea11c206c9e57773683888239da203e0dff

  • SHA512

    ab47ed31944215884d61db1cd1f54bf71e5135ddc7f16ff4aadd547f2409e87ab4038b7400fe83cec1746b084d6377eccbc1dcca1c2de642bd0dfcb0b74883c7

  • SSDEEP

    768:qCjDzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5k5MIM:qIeytM3alnawrRIwxVSHMweio3yMPm

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text"> <!--text data --> <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> [email protected] </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>�����������64 3E 7C EC 6D 2B 39 21 5F 2B BB B2 02 F2 F9 EC 2C A6 51 6F 5E F4 55 E3 43 8D 4A 92 C9 4C 8D 4C A7 FE 25 D7 24 D5 94 97 C0 B3 DE 68 F1 6F 3B 56 73 07 1D 8B A2 11 A0 52 ED D4 7C D4 BF ED 25 E4 4A DF 89 71 B9 CD 08 AA 7A FB 6A BF 95 D6 A1 D6 54 CE 48 B3 4E D3 12 63 80 3B 6D 02 EC CE CD FF 5B 0A 82 E3 69 AD DC A6 15 B3 05 EE 3F F1 D2 D2 4E 3B 34 C5 5E F0 BF C9 56 CD F0 76 98 67 C8 AE FF 85 4C F6 09 86 5E 04 59 C8 00 F9 10 41 D0 4B 4C B8 C1 D9 0A 43 A0 82 23 0F 28 D6 EF E0 52 89 6D C8 7C AF 39 16 92 78 67 25 FC A5 A0 D1 EF 7C D8 26 A8 52 CE A8 85 0A 08 3B F1 B6 0D 91 28 20 1B 0E 0C BD 6B 95 9E E5 B7 B7 B9 28 2A F9 6F 5A EA 98 5A DC AF AA 6F 26 9A 3A 88 27 72 80 39 A6 7B BA 37 6C 21 43 E6 6D 63 70 7D 33 5F E8 07 A6 53 24 97 A2 1B FB 8F 1A BB 2A 4E 91 4C 62 57 98 </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li></ul> <!--text data --> </div> </div> </div> </body> </html>������������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8690) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-05_71e99529c74cd2203188c802ec1b0da9_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-05_71e99529c74cd2203188c802ec1b0da9_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1924
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-05_71e99529c74cd2203188c802ec1b0da9_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-4177215427-74451935-3209572229-1000\desktop.ini
    Filesize

    1KB

    MD5

    9303b714736632f75eff802d54e8a923

    SHA1

    d24218bfd0ac91654b1d47f47429bfccd81f64ce

    SHA256

    594a472034a178a6c645771b3f8f563f6d205c8506025be3f2108edefda104f3

    SHA512

    0a6d2c90af019f86f2537eb4253a763dc3972ba2798e468bfcf72323354237ce743148772c0536d5e3a941f9978679330839fbb5faac51d69666d8655b63877f

    Download Submit

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    4KB

    MD5

    572ccea76325e93fb0fbbcb9a0a96733

    SHA1

    26f1a161cc7344e322a3334f6a3f55b7a962304f

    SHA256

    8e9cef87a93ebad61a6cf8950d3467291594744d298b6063b11c036fdfcf98ad

    SHA512

    96624609f634b2a6b5d47269e834e3cbb782d1504f638f57568375100a9ba5ebe1a1057cdfcec0f3f2fb58d2ee708f5d890013037ad5b7f9e70f2f9f4a15b186

    Download Submit

  • memory/1924-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1924-1216-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download