Overview

overview

10

Static

static

3

2025-03-17...er.exe

windows7-x64

10

2025-03-17...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    103s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2025, 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe

  • Size

    53KB

  • MD5

    c023089bc9f12e45e974688429188350

  • SHA1

    4178affe4951ae1c9f98adb9891432c5bc8a9d50

  • SHA256

    f373ca7e899cce69865c55be5a583aff18459489748ec55649e884d4be5ba434

  • SHA512

    554ceb05fa40a6f51ea98cb786f83d0cbea55af770e333f78fef597be63d7840626eab8ccd8ca9494d409a242643843d67b87cfabccecfc2ea82195614892bee

  • SSDEEP

    768:nTHwvuye1kVtGBk6P/v7nWlHznbkVwrEKD9yDwxVSHrowNI2tG6o/t84B5sQR+7C:eeytM3alnawrRIwxVSHMweio3Q+

Score
10/10
globeimposterdefense_evasiondiscoverypersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Public\Pictures\how_to_back_files.html

Ransom Note
<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>���������������3A 52 93 D5 CC 1F DC FD 9D E8 18 8F 4D A4 A1 6B 4C 2C 0D 64 87 F2 06 1C F8 28 FF B5 3D 44 DE B0 D6 84 91 81 7B BD 33 04 32 E6 B8 E0 27 A8 2F E3 B1 1A F8 80 E9 07 33 64 54 59 B0 51 8E 52 27 EC 55 0B 8E 15 5A FF 29 A3 56 7C 83 A6 B5 65 EE 74 D3 5F 39 79 FF 3D 1B 35 BA 00 10 67 6A 2D 46 24 6A 97 0A FF A6 43 68 19 9E 3D 44 F5 8A 1B 24 94 22 0C 6C B8 D6 2A 0D AA 00 30 DB 1D 8F 5B 31 39 17 A6 A2 7B EA 76 74 31 C4 98 73 26 A0 C2 65 3F CA AF 13 B2 81 A5 2A E6 50 81 7A 6F C0 AB 8E 5D 48 BC 10 95 5F D7 E7 C0 12 E1 8E 06 C4 E1 61 54 4B 5A 11 52 B1 54 C2 CB 41 99 47 C2 B0 C4 AC 18 07 DC F4 FD 9F 0D E3 07 7C 04 50 03 4C FF 10 5D 01 43 80 64 9F 2E 79 6A A1 FC 73 4D 36 C0 B4 97 C6 E1 61 B4 DD B3 0D AF 57 68 18 7D FB F8 41 BB 6D D5 1E AF 60 4F AF E4 1F 1E 33 56 6E D6 AB DA </pre><!-- !!! dont changing this !!! --> </div> </div> <!-- --> <div class="tabs"> <!--tab--> <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>&#9760; Your files are encrypted! &#9760;</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text"> <!--text data --> To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 test image or text file <span>[email protected] </span>.</br> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust [email protected]</li> <li>Do not attempt to remove the program or run the anti-virus tools</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul> <!--text data --> </div> </div> </div> <!--tab--> </ul> <!--text data --> </div> </div> <!--tab--> </div> </div> </body> </html> ��������

Signatures

  • GlobeImposter

    GlobeImposter is a ransomware first seen in 2017.

    ransomwareglobeimposter
  • Globeimposter family
    globeimposter
  • Renames multiple (8884) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 30 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5992
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2025-03-17_c023089bc9f12e45e974688429188350_globeimposter.exe > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3920955164-3782810283-1225622749-1000\desktop.ini
    Filesize

    1KB

    MD5

    255eecd6b2a803ba33815dd109823e4d

    SHA1

    cec1d14930746895a5bad182495652b873b26e93

    SHA256

    d28072f7567b11bc353318c58167313e1c0576b9256178efe452b3fbe2f5b699

    SHA512

    9f2679b111465b290e6026f27d239a8c238923438c276e6917ddb5c131696525c75b5ae16ba4380ad4fb95c1c886eb964640e1d5a4b94a52e96326eda71b9ecf

    Download Submit

  • C:\Users\Public\Pictures\how_to_back_files.html
    Filesize

    4KB

    MD5

    ec7746fd6bc8e65a00e21663e948aa66

    SHA1

    81536c74ce7daa43b00040788af71fa4d2e51bc7

    SHA256

    9dc3ce87f516264e9dc5488fc7be381e2ee00d36bd3084cce2eb782d8099284c

    SHA512

    78b8bb9116901f3e423429a1e8bb5ae83b1dbcc9047c3463118beb251e7f9b3087d3496db6b3df30f01d389c565c00f065b0537e529c173b361600aa024cb3f3

    Download Submit

  • memory/5992-0-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download

  • memory/5992-1993-0x0000000000400000-0x000000000040E200-memory.dmp

    Filesize

    56KB

    Download