Overview

overview

10

Static

static

3

2025-03-05...er.exe

windows7-x64

10

2025-03-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 21:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe

  • Size

    54KB

  • MD5

    6c360d684799cd00bb11e0331ada1027

  • SHA1

    be1dae6e24bf3070de9dbf55036181796e32bb28

  • SHA256

    3a6fcfcdaa2e90c617ebaf63fdf821956e890a188793b6dc88081deb31e2907f

  • SHA512

    aed13d5f3a87bcbf99b760ec8bb73b6cebeb74b6f9ec188644cb998d7a5357732388d6097dbf0849180004f26ca414b420956d63cba978742553b8da2ac57cc5

  • SSDEEP

    1536:OweytM3alnawrRIwxVSHMweio3/VuAY3:jey23alnaEIN/W/VjY3

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\Sample Videos\how_to_back_files.html

Ransom Note
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <style type="text/css"> body { background-color: #252525; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FFD700; background: #1C1A1B; } .letter { color: #FFD700; font-weight: 600 } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #1C1A1B; color: #F1EADA; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #F1EADA; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #1C1A1B; color: #F1EADA; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #1C1A1B; color: #E29F12; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head"><h3>Your personal ID</h3></div> <div class="identi"> <pre><span class="letter">�������������3D 96 36 D2 2D 10 F0 AA 9C 4E 2E F3 1F 5B 46 78 B4 83 20 12 78 60 5F 5B 6B 02 31 3E 1D FA 25 1E B4 79 F2 6E 67 E4 B3 A8 E0 40 4D B3 39 CA F5 45 D4 6E B2 60 D4 56 07 4D D6 A8 7F 24 74 6C A1 6F 9B 37 7D C8 57 9F 19 43 48 FF C9 BE AD F8 D0 D0 EC 0B 7F 53 0A D7 07 7B 56 A2 30 CF C1 50 CF DE 99 89 86 A2 BE C1 63 F6 34 1B 19 02 DB 13 8E FA 6C 83 FA 52 0C 16 E5 F4 84 C0 DA 39 8B 37 3A 80 9F C1 D3 2B C9 0D AA 65 47 DB 7D 19 88 04 35 26 82 F8 46 67 46 E1 B7 36 DC B7 12 1C 8B F5 15 FE B9 66 70 E0 DC 06 E2 A7 36 E0 4A 7C BD C0 EB 28 FF 47 69 5A 15 DF 50 76 A3 1A 59 FE 4C D0 C8 D6 BA 0E 2F 7A CE 51 81 31 94 53 AF 49 2D 81 62 16 1A 7F EF 28 6D 03 41 2A 97 CC B6 56 44 BC BF 24 7C 70 92 32 8E 91 A5 B7 38 11 4B 9B 46 1C 7D 2D 6D 10 07 B0 09 5C B6 D5 C1 E1 D7 DB 34 66 EB 23 </span><p></p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input name="tabs" checked="checked" id="tab1" type="radio"> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>? Your files are encrypted! ?</h1> <h3> To decrypt, follow the instructions below. </h3> <br> <div class="text"> <!--text data --> To recover data you need decryptor.<br> To get the decryptor you should:<br> <p>Send 1 crypted test image or text file or document to <span class="letter"> [email protected]</span><br> (Or alternate mail <span class="letter">[email protected]</span>)</p><p> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files<p></p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.<br> <p> <hr color="#FFD700"> <center><b><p style="color: #FFD700;">MOST IMPORTANT!!!</p></center> <center><p style="color: #FFD700;"> You can not decrypt your files cheaper than we offer you. You can refer to other services that promise to decrypt you, BUT IT WILL BE MORE EXPENSIVE. No one, except [email protected], will decrypt your files with a guarantee 100%. </b></p></center> <hr color="#FFD700"> <ul> <li>Only [email protected] can with a guarantee decrypt your files </li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> <!--text data --> </div> <!--tab--> </body></html>��������������
Emails

[email protected]</span><br>

class="letter">[email protected]</span>)</p><p>

[email protected]

[email protected]</li>
URLs

http-equiv="Content-Type"

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8647) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-05_6c360d684799cd00bb11e0331ada1027_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-677481364-2238709445-1347953534-1000\desktop.ini
    Filesize

    1KB

    MD5

    959ff5649b975991de629ae57871b24b

    SHA1

    82e37bb4fc64236a968c934d136498d09e4386bf

    SHA256

    903c01772d7c9f5ec23e3845c287a85542f0a4f8d3dd8258ebb60c107ab36465

    SHA512

    2a2225d230498fad2d451ba0c76535cd7c76a0c02bb87a22a572c8289cb0f7dc9cd1e709737827af89330bd796303e39ec3566139a233c84c38b6f529899a03b

    Download Submit

  • C:\Users\Public\Videos\Sample Videos\how_to_back_files.html
    Filesize

    5KB

    MD5

    94d89ba87250c035e3afeae413dbbb5e

    SHA1

    0f3e1fd0e14940ab36c47b49dec297b27f5d896d

    SHA256

    e2075c0ab07171fdaa477e41a070554e307db5015798f2858ba8ef45fa95d39c

    SHA512

    78c45b3f46eb36c3b60d7f9e6ee8af6c8cc3cbf51a038a2712b746f6a294dea51fbccaf6fdcdc351f233fb8e0302d7a116d4f9bdb8ca0de853b2de1e15bfa0f6

    Download Submit

  • memory/2532-0-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download

  • memory/2532-1430-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download