Analysis
-
max time kernel
1439s -
max time network
1479s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-08-2021 19:40
Static task
static1
Behavioral task
behavioral1
Sample
ital.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
ital.exe
Resource
win10v20210408
General
-
Target
ital.exe
-
Size
5.3MB
-
MD5
6bd9bcccf3b918b5b1b7d554f82c2fdf
-
SHA1
06cadd71039666315102aa5e46f52c45bec453a8
-
SHA256
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac
-
SHA512
c74a0c90f5c6e1f99f1aad0729b2fdb22e616d3070dca0852bc7f2c12b30703206f7bf171ef9e19807d7e9a9788cbc8416fb142fbdcd3625bc22c42acb73b176
Malware Config
Extracted
C:\1rWCqamCt.README.txt
blackmatter
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/LEOYRMQLSRHFGFGYWF2T5
Extracted
blackmatter
2.0
5791ae39aeab40b5e8e33d8dce465877
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Signatures
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
ital.exedescription ioc process File renamed C:\Users\Admin\Pictures\MeasureDebug.tif => C:\Users\Admin\Pictures\MeasureDebug.tif.1rWCqamCt ital.exe File opened for modification C:\Users\Admin\Pictures\UnblockInvoke.tif.1rWCqamCt ital.exe File renamed C:\Users\Admin\Pictures\OpenTrace.tif => C:\Users\Admin\Pictures\OpenTrace.tif.1rWCqamCt ital.exe File opened for modification C:\Users\Admin\Pictures\OpenTrace.tif.1rWCqamCt ital.exe File renamed C:\Users\Admin\Pictures\ProtectConfirm.png => C:\Users\Admin\Pictures\ProtectConfirm.png.1rWCqamCt ital.exe File opened for modification C:\Users\Admin\Pictures\ProtectConfirm.png.1rWCqamCt ital.exe File renamed C:\Users\Admin\Pictures\StepConvertFrom.png => C:\Users\Admin\Pictures\StepConvertFrom.png.1rWCqamCt ital.exe File renamed C:\Users\Admin\Pictures\EnterUninstall.tif => C:\Users\Admin\Pictures\EnterUninstall.tif.1rWCqamCt ital.exe File opened for modification C:\Users\Admin\Pictures\EnterUninstall.tif.1rWCqamCt ital.exe File opened for modification C:\Users\Admin\Pictures\MeasureDebug.tif.1rWCqamCt ital.exe File opened for modification C:\Users\Admin\Pictures\StepConvertFrom.png.1rWCqamCt ital.exe File renamed C:\Users\Admin\Pictures\UnblockInvoke.tif => C:\Users\Admin\Pictures\UnblockInvoke.tif.1rWCqamCt ital.exe -
Processes:
resource yara_rule behavioral1/memory/2012-61-0x0000000000830000-0x00000000010C3000-memory.dmp vmprotect -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
ital.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\1rWCqamCt.bmp" ital.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\1rWCqamCt.bmp" ital.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
ital.exepid process 2012 ital.exe 2012 ital.exe 2012 ital.exe 2012 ital.exe 2012 ital.exe 2012 ital.exe -
Modifies Control Panel 3 IoCs
Processes:
ital.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International ital.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop ital.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\Desktop\WallpaperStyle = "10" ital.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
ital.exepid process 2012 ital.exe 2012 ital.exe 2012 ital.exe 2012 ital.exe 2012 ital.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
ital.exevssvc.exedescription pid process Token: SeBackupPrivilege 2012 ital.exe Token: SeDebugPrivilege 2012 ital.exe Token: 36 2012 ital.exe Token: SeImpersonatePrivilege 2012 ital.exe Token: SeIncBasePriorityPrivilege 2012 ital.exe Token: SeIncreaseQuotaPrivilege 2012 ital.exe Token: 33 2012 ital.exe Token: SeManageVolumePrivilege 2012 ital.exe Token: SeProfSingleProcessPrivilege 2012 ital.exe Token: SeRestorePrivilege 2012 ital.exe Token: SeSecurityPrivilege 2012 ital.exe Token: SeSystemProfilePrivilege 2012 ital.exe Token: SeTakeOwnershipPrivilege 2012 ital.exe Token: SeShutdownPrivilege 2012 ital.exe Token: SeBackupPrivilege 1888 vssvc.exe Token: SeRestorePrivilege 1888 vssvc.exe Token: SeAuditPrivilege 1888 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ital.exe"C:\Users\Admin\AppData\Local\Temp\ital.exe"1⤵
- Modifies extensions of user files
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2012-61-0x0000000000830000-0x00000000010C3000-memory.dmpFilesize
8.6MB
-
memory/2012-62-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2012-63-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/2012-65-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2012-64-0x0000000000245000-0x0000000000256000-memory.dmpFilesize
68KB
-
memory/2012-66-0x0000000000256000-0x0000000000257000-memory.dmpFilesize
4KB