Overview

overview

10

Static

static

3

2025-03-05...er.exe

windows7-x64

10

2025-03-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 21:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe

  • Size

    53KB

  • MD5

    c6a8f1bad2dd8e9c25b4f172a3d6c907

  • SHA1

    ac461efd37d5c032c5ec0f312fcd628358fc7e3b

  • SHA256

    1e72089c6aedcc8dc25edce3dcc021aa53e8f3fcf72fc3f4c98657b542f3fad8

  • SHA512

    48dfe1985c34571cd5da0e23d6ec4b28e810afed132b5fc44311ae06788d9b68ac6710188caecdc8167b72463e93f60ea28f87f4c55f0ad0a43a14e7d7c2233b

  • SSDEEP

    768:qHTzvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5f8Y:qHLeytM3alnawrRIwxVSHMweio3xp

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #ff0000; } .tabs1 .identi { text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; /*height: 30px;*/ background: red; } .tabs .tab{ /*float: left;*/ display: inline-block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 15px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #ff0000; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 100%; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; outline: 1px solid red; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="on" id="tab1" /> <div id="tab-content1" class="content"> <h1>Your files are encrypted! </h1> <hr/> <div class="text"> <!--text data --> <center>Your documents, photos, databases and all the rest files encrypted cryptographically strong algoritm.<br> Without a secret key stored with us, the restoration of your files is impossible</center> <br> <center>----------------------------------------------------------</center> You will be able to restore files so: <ul><li>To contact us by e-mail: <strong> [email protected] </strong> & send your personal ID and 3 crypted files, up to 3 MB in size everyone.</li> <li>We will decipher them, as proof that we can do this. Also you receive the instruction where and how many it is necessary to pay.</li> <li>You pay and confirm payment.</li> <li> after payment you receive the DECRYPTOR program, which restored ALL YOUR FILES.</li></ul> <center>---------------------------------------------------------</center> <strong>Your personal ID:</strong> <pre>������8B CD BD 26 61 E2 A7 E3 5A D4 99 0F 88 81 6D AC 99 37 6C D5 B2 74 37 FD 61 38 52 BD 54 84 51 D4 0C 72 F2 35 1C 02 0A E5 38 19 4B 6E D4 EE 76 3C 13 F5 FF BC 44 10 A3 7E 50 B9 94 DA 1E 5E AA 77 79 38 8B 0E 0A 5F 5F 77 EA 1A 18 E8 4B 45 08 27 2C 7A 7D F0 EC AB 80 65 96 20 E6 BF 0F 6F 6B 88 85 ED 8C 5E 89 88 10 F1 BD 7C 36 5F 95 F6 BA F6 5B 54 1B F4 2F 95 44 E6 2A 3E 69 34 EF D8 17 16 E1 17 99 7A F7 56 D0 C2 F9 88 AF 67 8A B6 42 8A 18 53 35 BC 4E 95 E9 FE D7 7E 66 40 4B 66 75 EF 9C 2D 0E 9A 48 CA 82 81 A4 3E 8C DB CB 5B 06 2D B0 57 9E FD 3A AA BF 6E FC 00 F3 09 CD C8 66 CB 92 15 12 B1 1F 10 42 AA B1 E3 CE AC 3D 29 5B 75 CC CC 8B 85 2B FB C9 69 8F B1 A3 46 C5 72 2F 22 C6 BD 80 06 E7 FB 71 B0 15 2C 87 D8 9E DD 98 50 00 EF 83 41 82 0F 04 64 97 14 24 32 32 B3 93 0F </pre> <center>----------------------------- P.S. ----------------------------------</center> <ul><li>It is in your interest to respond as soon as possible to ensure the recovery of your files, because we will not store your decryption keys on our server for a long time.</li> <li>If we do not respond to your message for more than 48 hours, write to the backup email : <strong> [email protected] </strong></li></ul> <!--text data --> </div> </div> </div> </body> </html>�����������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8665) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-05_c6a8f1bad2dd8e9c25b4f172a3d6c907_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3533259084-2542256011-65585152-1000\desktop.ini
    Filesize

    1KB

    MD5

    e0e35ff267bef3a7bb99cf06ff8fee3e

    SHA1

    ea8015e5ed5ce8991e1e5a95ced9c4d1348f9e68

    SHA256

    96d4d3ae4f85c56204edf58278240789856035825ea7cf96bfa96753abb48dd0

    SHA512

    a39c44065a4dca774274dfb141c19f63db36e3db63124afabbdf438919bac40e307282a8cdce50e0aa86f79a805b9a59cbcb43cfd3ce5ac4b9c67c76cb679c6e

    Download Submit

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    4KB

    MD5

    9b5c07cff57383b38557b21e906a2f25

    SHA1

    3dbb6ee64a9b60fa91249f5d4bb1010ff6b79225

    SHA256

    55233bf2384c4722a463d06aa6211d30ca99c6071ef4937bdd69e9370f712607

    SHA512

    8a8878a047a1bad726e83072e37fd3076070b01a9c1b96929a4f9078b1c991925707efb5160d95d5c09e71ae53eba848fa1fab411b8e94006d610c38749c5ff3

    Download Submit

  • memory/1232-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1232-1598-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

    Download