General
-
Target
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac
-
Size
5.3MB
-
Sample
211103-raaz9abbbk
-
MD5
6bd9bcccf3b918b5b1b7d554f82c2fdf
-
SHA1
06cadd71039666315102aa5e46f52c45bec453a8
-
SHA256
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac
-
SHA512
c74a0c90f5c6e1f99f1aad0729b2fdb22e616d3070dca0852bc7f2c12b30703206f7bf171ef9e19807d7e9a9788cbc8416fb142fbdcd3625bc22c42acb73b176
Static task
static1
Behavioral task
behavioral1
Sample
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac.exe
Resource
win10-en-20211014
Malware Config
Extracted
C:\6amPnJyPq.README.txt
blackmatter
http://supp24maprinktc7uizgfyqhisx7lkszb6ogh6lwdzpac23w3mh4tvyd.onion/LEOYRMQLSRHFGFGYWF2T5
Extracted
blackmatter
2.0
5791ae39aeab40b5e8e33d8dce465877
-
attempt_auth
false
-
create_mutex
true
-
encrypt_network_shares
true
-
exfiltrate
false
-
mount_volumes
true
Targets
-
-
Target
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac
-
Size
5.3MB
-
MD5
6bd9bcccf3b918b5b1b7d554f82c2fdf
-
SHA1
06cadd71039666315102aa5e46f52c45bec453a8
-
SHA256
8323fdfda08300c691d330badec2607ea050cc10ee39934faeebedf3877df3ac
-
SHA512
c74a0c90f5c6e1f99f1aad0729b2fdb22e616d3070dca0852bc7f2c12b30703206f7bf171ef9e19807d7e9a9788cbc8416fb142fbdcd3625bc22c42acb73b176
-
BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
-
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (mojobiden .com)
-
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
suricata: ET MALWARE BlackMatter CnC Domain in DNS Lookup (nowautomation .com)
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-