Overview

overview

10

Static

static

3

2025-03-17...er.exe

windows7-x64

10

2025-03-17...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/03/2025, 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe

  • Size

    53KB

  • MD5

    c023089bc9f12e45e974688429188350

  • SHA1

    4178affe4951ae1c9f98adb9891432c5bc8a9d50

  • SHA256

    f373ca7e899cce69865c55be5a583aff18459489748ec55649e884d4be5ba434

  • SHA512

    554ceb05fa40a6f51ea98cb786f83d0cbea55af770e333f78fef597be63d7840626eab8ccd8ca9494d409a242643843d67b87cfabccecfc2ea82195614892bee

  • SSDEEP

    768:nTHwvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5sQR+7C:eeytM3alnawrRIwxVSHMweio3Q+

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������88 D5 0E 0F D0 A1 3F 88 93 A4 12 53 1D A1 47 9F 53 53 D0 D5 2D 3D 71 FE A9 8A 9A D8 0A 1B F1 DD 92 7A 72 7D 81 8F 42 86 E9 60 84 73 4C CD 51 7B A1 1C D8 15 1E 25 E6 63 A9 97 29 3A EE C7 AB 84 B0 61 2B D4 B8 FA 77 1C 05 B8 E4 D4 15 4C F7 05 9B D0 EF 54 03 93 26 8E 9D 49 6F DF 18 02 BB DE C0 ED 69 3F 36 F3 6E 6A 82 B5 F5 97 EA E5 29 60 35 B5 8F C6 52 F2 34 A5 94 36 A7 FD E6 50 FC 5B 04 09 85 64 B4 B1 CD 80 3C 68 B7 17 EE 08 40 52 DA F7 06 22 8F 9D 09 92 62 18 19 C5 58 8B B9 C2 EF F4 C7 C4 56 85 64 72 94 43 7B FD C0 AF 25 4E 3A B8 6B 04 55 9B E1 85 9E 7F 41 9B AF 99 9D D9 55 DF A0 C5 71 2F CE 67 E2 DD 39 B6 A2 FC DA 90 53 FC A9 4B 0A FF 3A 99 42 2C 5D B7 EE 20 24 04 E7 D2 06 A2 DE D1 FE 3F 6E 56 49 99 BE 88 85 8D 34 98 C4 60 65 71 84 08 6F 35 83 A4 B9 14 68 61 </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 test image or text file <span>[email protected] </span>.</br> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust [email protected]</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ��������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8372) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 38 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe > nul
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini
    Filesize

    1KB

    MD5

    a22403aa1409913ebfb3e9db0dcd8e45

    SHA1

    c056ffb84a27ac23add12c823e6669bcc47c6d29

    SHA256

    1a8c60cfa5ea0eb6b781fd9cd52db737de23000bd7b2752b2bc369c2c2c85bfe

    SHA512

    31a2243818539dcc78613121ad709c4fd26e1b17d76db9f64232f5ce4c9f67e588dc5331f99572d72f16fad3be375af1a40e5ec610efb9072ccfbfdb2578f9d1

    Download Submit

  • C:\Users\Public\Videos\how_to_back_files.html
    Filesize

    4KB

    MD5

    45cc4e277c3495729070aaf7c4ab6713

    SHA1

    f1221b829a64ed390c76c0911f329667d58cee95

    SHA256

    1066071dcbcd7537120a31301ea27dc2ff1209b17370c9ef2fb9bc7118f9d50e

    SHA512

    4957621da75886884294d665a964e4030b5099550489ec6040313964daf6ddccf94268a10b9087268cd6d7001d597ba6018dd219950bd61603e7cc1faa2efc6e

    Download Submit

  • memory/2528-0-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download

  • memory/2528-1436-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download