Overview

overview

10

Static

static

3

2025-03-05...er.exe

windows7-x64

10

2025-03-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 21:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-05_71697d46ac097dbaba3209e052feb9a9_globeimposter.exe

  • Size

    54KB

  • MD5

    71697d46ac097dbaba3209e052feb9a9

  • SHA1

    39b49b28823619a816139e9277f6ad74f5277360

  • SHA256

    3f5f09f67d846f65e983dba8075d45b1047b51615ea3d72d4b7e3739ee34fe34

  • SHA512

    c17ef0397a297b2bd2230e65947d608d20cf516818fe755e95633ce6cb2d30305f6725e4b381e15724db25d4dfe3be75ca9487a0acf6d6ce3a56e4a5c0514f34

  • SSDEEP

    768:IiMvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5HmbSDt:OeytM3alnawrRIwxVSHMweio3Fz

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 5px; color: #FF0000; background: #303030; } .tabs1 .identi { margin-left: 0px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top:0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��0F DC CA FB 71 18 1A 78 7F 1E 3A 15 40 8C 11 08 78 24 E8 73 6E 40 D0 14 B6 82 D0 6A 75 CB AE 2C DA 4D C8 E8 24 72 7D 05 E2 14 01 8D 15 24 F4 E9 89 AC D6 5B E3 0D DB 4A A5 6F 6B 7A B6 B3 FF A8 F4 62 68 A4 83 6C E2 CD B0 54 D7 D9 58 DB 73 B3 82 0A C7 CE 26 77 5B F3 7B 5E E2 23 A9 E0 FF 32 68 0A A6 A7 70 26 2B 69 4A 17 2B 09 E5 B4 A1 41 87 B3 E5 F4 51 45 32 43 A8 32 40 B6 E8 08 4E 65 31 9F 72 B5 5E F3 FA 66 5A D3 C4 1B FC B1 21 E0 A0 E8 8F 2E FF 09 E6 72 28 78 43 BA 29 5F 26 D9 03 15 0E B3 8D 2C 34 28 89 E0 E3 65 95 1E C8 9E A5 A2 1A 43 D7 19 46 AC 1B A6 1B AC 39 A3 EE 97 AE 29 6E 54 04 5B 38 B3 7B AC E5 13 B0 9C 55 17 D0 4F AC 46 CD C4 58 9B DF 1C E7 CF F2 C2 B6 AB AA D1 94 A3 EC F9 81 5D F5 70 86 33 7F 84 8A 1F 75 BC 2D 1B 51 18 AF 2E 45 87 30 AE 34 D1 57 82 </p> </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9763; Your files are encrypted! &#9763;</h1> <hr/> <h3> &#11015 To decrypt, follow the instructions below. &#11015 </h3> <br/> <div class="text"> <!--text data --> To recover data you need decrypt tool.</br> To get the decrypt tool you should:</br> <p>Send 1 crypted test image or text file or document to <span> <font color="FF0000"> [email protected] </font></span></br> (Or alternate mail <font color="FF0000"> [email protected] </font>)<p> In the letter include your personal ID (look at the beginning of this document). Send me this ID in your first email to me</p> We will give you free test for decrypt few files (NOT VALUE) and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt tool and after payment you will receive a decrypt tool and instructions how to use it We can decrypt few files in quality the evidence that we have the decoder.</br> <hr color=red> <center><p style="color:#FF0000">MOST IMPORTANT!!!</p></center> <center><p style="color:#FF0000"> Do not contact other services that promise to decrypt your files, this is fraud on their part! They will buy a decoder from us, and you will pay more for his services. No one, except [email protected], will decrypt your files.</p></center> <hr color=red> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone besides [email protected]</li> <li>Antivirus programs can delete this document and you can not contact us later.</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ����������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8649) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-05_71697d46ac097dbaba3209e052feb9a9_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-05_71697d46ac097dbaba3209e052feb9a9_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-05_71697d46ac097dbaba3209e052feb9a9_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1846800975-3917212583-2893086201-1000\desktop.ini
    Filesize

    1KB

    MD5

    9e1eb9d8fcd7481f322a6174e2acb70d

    SHA1

    a9333f0abc0de15b975e61b094b34755932c2f8a

    SHA256

    edbbbd192e7019788462eb180fa023a811016cd77adc01b2b04996253afdd001

    SHA512

    9a10ede40bd0be7f0d0bc7cc347fb45e0319011ade060ab3420656300bc699bcc63265df290f838f20ce4815025c61a92ad12d8350c6ca1176250942ee7cfa58

    Download Submit

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    5KB

    MD5

    db514ca8bc1825ac6492711de0447cef

    SHA1

    29e6da55c5b6bbb4e5c24eed10767f3440232c7a

    SHA256

    87cf5cb8dbaa712421c7c9d86e51749031bca310f9ef269814058440fe18de38

    SHA512

    d75c8a6d05dc540717549ee43b408779a8a3b323c84a16b723990f353250d74fa38499ab65595d147f173964f8afe5ed59b7702b833c97a772a6982e9093bcf7

    Download Submit

  • memory/2908-0-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download

  • memory/2908-1376-0x0000000000400000-0x000000000040E400-memory.dmp

    Filesize

    57KB

    Download