General

  • Target

    6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b

  • Size

    887KB

  • Sample

    210803-6ltwl2zf42

  • MD5

    66d8f3d21088cea87dd99f37efb92795

  • SHA1

    ba7cad1cbb5204ac8d2ddb3d399738657f08e209

  • SHA256

    6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b

  • SHA512

    df0cd4d9a9c3337aed6a62bce14ddb3c6001e215ab956f7f0e98d9a9c7ae69ec24fc2aff48cc5899312f8473f397f9d9bcf554b5b9ef626a8c95f257f5f23554

Score
10/10

Malware Config

Extracted

Path

C:\1rWCqamCt.README.txt

Family

blackmatter

Ransom Note
~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >>> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R. >>> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.
URLs

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/GDBJS76DH3D4IKQD2QO7R

Targets

    • Target

      6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b

    • Size

      887KB

    • MD5

      66d8f3d21088cea87dd99f37efb92795

    • SHA1

      ba7cad1cbb5204ac8d2ddb3d399738657f08e209

    • SHA256

      6155637f8b98426258f5d4321bce4104df56c7771967813d61362c2118632a7b

    • SHA512

      df0cd4d9a9c3337aed6a62bce14ddb3c6001e215ab956f7f0e98d9a9c7ae69ec24fc2aff48cc5899312f8473f397f9d9bcf554b5b9ef626a8c95f257f5f23554

    Score
    10/10
    • BlackMatter Ransomware

      BlackMatter ransomware group claims to be Darkside and REvil succesor.

    • Blocklisted process makes network request

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Sets desktop wallpaper using registry

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks