Overview

overview

10

Static

static

3

2025-03-05...er.exe

windows7-x64

10

2025-03-05...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2025, 23:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-05_8cabf7aad09357ff658e078c01d41dd2_globeimposter.exe

  • Size

    53KB

  • MD5

    8cabf7aad09357ff658e078c01d41dd2

  • SHA1

    2377520778ced3e5318cb2dda637ec6f8397a08e

  • SHA256

    622d171ff8e947e6a57fff1eb063e40c5b40338dd039e7ce71e613774b4c3cac

  • SHA512

    4e8559a352e49f87fa8a80b910785ed06ea5fd59c70e35fa403eeafde314ffc96b515912825d2092572c6f49a3a36db006d747bc62d52df94cf4e40f3417406e

  • SSDEEP

    768:5/tvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5InneoT:FVeytM3alnawrRIwxVSHMweio3S

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre> <div>��������38 03 6F 64 DB 22 D7 EE F3 60 9D 4C B3 F2 59 DD 26 B1 F8 8C 6B 5D 86 15 BB 31 54 AF 92 5F E7 55 A6 CC 45 4C D8 1B EF 3E 4B 5F 5A B8 D0 C5 7C 76 A8 8E D6 C5 9C E4 30 22 E6 BB 90 A8 7C 47 65 16 A0 EB 32 1A 29 B5 74 99 17 71 D3 C3 05 B6 3B D3 DB 57 E5 87 A6 78 5F FD 4B 4A A0 49 C0 E3 25 64 1C A7 69 57 67 A1 19 32 28 FA 65 82 10 85 D3 06 A4 3E 14 D9 4E 94 6C AC 44 5A 4B CC EC 36 61 C2 7D 40 3D 8F 79 F4 DB 40 4D 03 7D B5 D4 45 D0 64 00 EE 2E 31 23 AF 1C 20 0F C1 28 4F F3 41 6A 4F FA F6 2F 2E 06 14 C2 0C D4 C9 73 27 DE 3E 68 DC AB A3 86 60 39 41 9C 22 13 51 44 39 47 2C 3A E2 6E 7C 47 1E DC FF E5 86 CA 83 BC 0D C3 83 6F 61 DE 3B FA BC 6E A9 09 00 2C AE 1E 3F 5B 81 B6 2F 40 AA 7B 32 3E F8 99 21 A4 F6 D6 DE 86 66 F9 C6 5B 7B 51 99 B4 F3 92 90 6F A6 AD E8 30 81 E5 E3 </div> </pre> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 test image or text file <span>[email protected]</span> or <span>[email protected]</span>.</br> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> �����������
Emails

<span>[email protected]</span>

<span>[email protected]</span>.</br>

[email protected]

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (6191) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-05_8cabf7aad09357ff658e078c01d41dd2_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-05_8cabf7aad09357ff658e078c01d41dd2_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-05_8cabf7aad09357ff658e078c01d41dd2_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\how_to_back_files.html
    Filesize

    4KB

    MD5

    5cf88962e1fee7023f3ade0e5419f752

    SHA1

    a14bedcf5d3ac52fdb54353d3280da264b07541f

    SHA256

    15387d4ebdcf960bd5c526bf2b6e1ec3705339f8051c4674c8e4270dbd60c04c

    SHA512

    b9752fe46cfd189b5e7bb1e6e1bf2bf96827df590effd4a62e3769dea5d95f1ef1e6a499d7b53527da558ab09cd6c09b73b69717f46cdda7ba98f9893b143d25

    Download Submit

  • memory/3764-0-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download

  • memory/3764-1246-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download