Overview

overview

10

Static

static

10

00260c390f...f8.exe

windows7-x64

10

00260c390f...f8.exe

windows10-2004-x64

10

01bf78841b...16.exe

windows7-x64

9

01bf78841b...16.exe

windows10-2004-x64

9

0545f842ca...49.exe

windows7-x64

10

0545f842ca...49.exe

windows10-2004-x64

10

068ca3e92c...fd.exe

windows7-x64

10

068ca3e92c...fd.exe

windows10-2004-x64

10

0b856337d9...c9.exe

windows7-x64

10

0b856337d9...c9.exe

windows10-2004-x64

10

0d38f8bf83...09.exe

windows7-x64

10

0d38f8bf83...09.exe

windows10-2004-x64

10

0e35a681fc...5e.exe

windows7-x64

10

0e35a681fc...5e.exe

windows10-2004-x64

10

0f178bc093...35.exe

windows7-x64

10

0f178bc093...35.exe

windows10-2004-x64

10

10306702a1...dd.dll

windows7-x64

10

10306702a1...dd.dll

windows10-2004-x64

10

160c972897...21.exe

windows7-x64

10

160c972897...21.exe

windows10-2004-x64

10

19f7d53c4a...a0.exe

windows7-x64

10

19f7d53c4a...a0.exe

windows10-2004-x64

10

1b109db549...18.exe

windows7-x64

10

1b109db549...18.exe

windows10-2004-x64

10

1e10e08cda...18.dll

windows7-x64

10

1e10e08cda...18.dll

windows10-2004-x64

10

1eb0b48ca7...1d.dll

windows7-x64

1

1eb0b48ca7...1d.dll

windows10-2004-x64

1

1f0e4cbc1a...7d.exe

windows7-x64

10

1f0e4cbc1a...7d.exe

windows10-2004-x64

10

239c9969fd...90.exe

windows7-x64

10

239c9969fd...90.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

Errors

Reason
config extraction: Blackmatter: EOF

General

  • Target
    b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24
  • Size 35.6MB
  • Sample240318-ky38dadf6s
  • SHA256 b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaoslockbitneshtablackmatter

Malware Config

Extracted

Family

  • blackmatter

Version

  • 25.239

Extracted

Family

  • blackmatter

Version

  • 65.239

Signatures

  • Blackmatter family
    blackmatter
  • Chaos Ransomware 2 IoCs
  • Chaos family
    chaos
  • Detect Neshta payload 3 IoCs
  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 25 IoCs
  • Detects command variations typically used by ransomware 8 IoCs
  • Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 25 IoCs
  • Detects executables containing commands for clearing Windows Event Logs 6 IoCs
  • Detects executables containing many references to VEEAM. Observed in ransomware 6 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 17 IoCs
  • Detects executables packed with ConfuserEx Mod 1 IoCs
  • Detects executables packed with VMProtect. 1 IoCs
  • Lockbit family
    lockbit
  • Neshta family
    neshta
  • Rule to detect Lockbit 3.0 ransomware Windows payload 64 IoCs
  • UPX dump on OEP (original entry point) 1 IoCs
  • Unsigned PE 101 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24
    .zip 35.6MB
  • 00260c390ffab5734208a7199df0e4229a76261c3f5b7264c4515acb8eb9c2f8
    .exe 862KB
  • 01bf78841b63bcdd8280157c486b45ad74811c0251140a054de81a925ce7f716
    .exe 145KB
  • 0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049
    .exe 959KB
  • 068ca3e92c65eb907b5a34be16580e267efbbde6f9129ca30ad80c948a1d3ffd
    .exe 147KB
  • 0b856337d9d3255fc3b07635fdadecbe83e23eb5c205eccab83c21c2fb76edc9
    .exe 150KB
  • 0d38f8bf831f1dbbe9a058930127171f24c3df8dae81e6aa66c430a63cbe0509
    .exe 162KB
  • 0e35a681fc6574663201af8af49d621097ed4c3fba8cd058a82b22dea8bccc5e
    .exe 959KB
  • 0f178bc093b6b9d25924a85d9a7dde64592215599733e83e3bbc6df219564335
    .exe 151KB
  • 10306702a13bfd1d9c8208394eaf42eddcbe49a03f039f7715ad31579db2b6dd
    .dll 103KB
  • 160c97289764c37afe1a11f72537e95843a9c37a9c5fa02e1046f6b002315021
    .exe 153KB
  • 19f7d53c4a9ba784fd4c64a06fc6a88caf5a4d9913341a625582d51b1c095ba0
    .exe 959KB
  • 1b109db549dd0bf64cadafec575b5895690760c7180a4edbf0c5296766162f18
    .exe 150KB
  • 1e10e08cdaa10e1c490dcfe4773f1a72183d340f880d19e89a54965c37aa3518
    .dll 113KB
  • 1eb0b48ca74c119b53d372de7d639f0bcb1337fb526347fb3b22f62214280e1d
    .dll 158KB
  • 1f0e4cbc1a4b52b6d7e4188e4a835a904cf783c75db9a066df4201452bd9647d
    .exe 153KB
  • 239c9969fd07e1701a129cfd033a11a93ee9e88e4df4f79b7c5c0dd5bba86390
    .exe 153KB
  • 286726ecca68f8c2752116258aba0cd35c051a6342043ee1add84b890654276f
    .exe 200KB
  • 2a32c844885b05e65769a051dae825aecef887c2c60035e5a20ae42533cc1695
    .exe 959KB
  • 2bef6231c3e742815f5a3a1da2861bccd7a4197aa1387a70f297a714afbb6495
    .exe 959KB
  • 2e218735fa53e036659ea721bfd7b97e2af67b7eda648e9e2579356eb20899d9
    .exe 159KB
  • 2ecf1fe02d8fb099b68e4d9bceeeadbe5fc8347f5a76d52f35ed48b516963735
    .exe 959KB
  • 2ee6dfbfb2afd7442c9f2212eb142876698851c3ffb552ee420c0281e35a836e
    .exe 4.9MB
  • 3766cc743fed6fdb2d9f7822f85e5b9bbafcbdccc25a1fe608bff12699849580
    .exe 150KB
  • 38f3ed729bea9787d7378f9dae8d12c7d4af555b643db8382b840dc0f03b8995
    .exe 149KB
  • 391a97a2fe6beb675fe350eb3ca0bc3a995fda43d02a7a6046cd48f042052de5
    .exe 162KB
  • 3d475c0e54a34cfebd641e295dedeacddf087d29dee6129a99d44a73b05e69a4
    .exe 959KB
  • 3e04fe9f427717ca17142603b46c5264fb42621048719721ffa4926c8e9bb6f1
    .exe 153KB
  • 4129e2b6acc9fe06dca2b3e2012b219560e7587a9718269aac317d6550f6e70a
    .dll 148KB
  • 4bdda7dd3bbe1f9cb0a7d42f6947ba0f6442e52758bd2638541f9409b573d5c9
    .exe 153KB
  • 4cefaa9c547f282b73828d5330a47d774fbf23e9cdafe1e4dc7507e9415ddb3e
    .exe 145KB
  • 4ec749635f2fc719d569c97a868a071f486923f63ed71eecec9fa0d62278bbca
    .dll 146KB
  • 5181d2e71e8e73a82712a483a80aaea94e1efa785f2b8b8ee9641544c0b652f0
    .exe 959KB
  • 54ac7ac6db6fcec5234454430513d1d2787ee8a48aa60fbf95c1af27534fdb4a
    .exe 159KB
  • 54b45f35926b12f7853e4854ae1d0a233ba1817451450d9b9fdf4e9b1412024f
    .exe 959KB
  • 559db69c65b706eaacd9c0c217ed8c7390a1978a8094a1fad5d86ccdd12f8697
    .exe 149KB
  • 571a0b0b517179ab2ef9a799cd66437fe07e2459d75b76f53307f5e13b1159b0
    .exe 159KB
  • 5735ea71ae9c58fe79c5049056421cf68600d6afdac1c441ae02291637779816
    .exe 145KB
  • 588dfcd0e8ebc570eaba342d6d220528a722be93a46c2dfa2306a7b662b25845
    .exe 146KB
  • 5c6a887b673b372ffa7bedf473edf602031b605ebfbe4f715ed0256b4f6da0a1
    .exe 153KB
  • 5cca70d1770bbd15c40fd7746c3dee4d295367185fd31f0d93ea4ec7a6e5723f
    .exe 104KB
  • 64aa8889a8b3298487242ae21c9cf97a763bf905223a445d599f76327e8193f1
    .exe 153KB
  • 66cbbeae5d9afbae6cffca41b5bfcc0f3e5fa2bd9746692796710e3425d78b5f
    .dll 148KB
  • 66f7a4ea923ecc8cdaa74b930cbd103b7170e06585c3f4dbfb7c113e05beaa02
    .exe 142KB
  • 67b05e96f47db0447da53beddbf9aff265cd02562c12428d787fdab0278ded2e
    .exe 159KB
  • 6b4502d8ba3cff1a3139f72cdad863d53551b65b8c38d7b838d64212822e4630
    .exe 153KB
  • 74437ac6c9f630c52c7e230d57d38c4cbc3affb3bec9215f090a0e3dca8e9d78
    .exe 959KB
  • 770919c4b0015956098a1a8002fa00dfa44eadfdef699320d3f577aa89b56b0a
    .exe 155KB
  • 77a9d533452247d58d64c05f469703fac3f3fe69294fd51f86b24cb7b2d4a710
    .exe 151KB
  • 7a59f387a926696968bea7c8f891e79d7410c989bd6f20b77a3e5a2a29f0363e
    .exe 147KB
  • 7ba8bebf45f155fcaa7ac341106fd9366051d5999a28ebeabb7acb22f8737433
    .exe 959KB
  • 7eea0bf98a5142c544fac25063a28f39079468206898fa043dd31e83c1b450fb
    .exe 153KB
  • 80e8defa5377018b093b5b90de0f2957f7062144c83a09a56bba1fe4eda932ce
    .exe 162KB
  • 851bac9a300e0733392fedeebcec45758c8e785d854fffecee3cd5819abf5d49
    .exe 153KB
  • 8776879e76c6554c6b746cf17a258527b1a1fe19720e8516ccabb50750f71830
    .exe 159KB
  • 8989a9aec8d2c4d61fa399a97807f8e62814b1a55fecbd38d11d4d35fdf4a7d1
    .exe 159KB
  • 8bbc2a1290ffa8ba7074beb4fc4f4beaa45b82b89677f258e7b686ebb0e1cff9
    .dll 152KB
  • 8d62edc1873f8a8b8415bb56d572786a96bd337eaafcf3dbd7666ba4442553fb
    .exe 959KB
  • 92ebb2dce3e8f3d0e919c0342fdbe9a37d672a0cca6b105395745ebc783de6e5
    .exe 145KB
  • 9366a5b8021d0283156986bbf020c99ae5e2a3dcbbaa03db934e94bfa7088b86
    .exe 159KB
  • 950906032eccd7c0670bb6fa363c60d18b0c4ac937f031e10e294b2abca06c1d
    .dll 107KB
  • 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
    .exe 146KB
  • 9704b41b277688eb96fc47a743dfdabcc27489f15c764d0dd409cbddd8e41289
    .dll 107KB
  • 98900768d564c6962981edde2759889fdda11bb1113c851468e5c40ddafe1d4d
    .exe 1.8MB
  • 98f0e0bdfd9d823ed46cb2d21d9a6df6c3dfce1b7e4eed4e1344615bc3028e6a
    .exe 488KB
  • 99d3003cc577c3635bcbb883634037469b35c3b1a31109dc145600bb1e683d4b
    .exe 145KB
  • 9ab96686cbd062162639566567a22e195109ebe558394440136d34fec079e5ba
    .dll 107KB
  • 9feed0c7fa8c1d32390e1c168051267df61f11b048ec62aa5b8e66f60e8083af
    .exe 959KB
  • a2757fc68cd1b177a13248609c4dcde253f17b30eef8ab2e4f88914f9cd6e667
    .dll 152KB
  • a35c3274a726b27cbcef5abe3f28d8f9675a30883490d37f23b4d730d72eca42
    .exe 146KB
  • a439c5093801d3b12e2f79b64c0b65bdf148eb6eca8c1e3d179af5ab4995034d
    .exe 159KB
  • a56b41a6023f828cccaaef470874571d169fdb8f683a75edd430fbd31a2c3f6e
    .exe 162KB
  • a6913ed2fa42ead86c2d7e36f0d0ca17e39a89cd55944f4777b87e92cc7b9818
    .dll 152KB
  • a736269f5f3a9f2e11dd776e352e1801bc28bb699e47876784b8ef761e0062db
    .exe 469KB
  • a80d30593de634968f48f307872cae672efa109fa4d66fd72eceb314c683399a
    .dll 154KB
  • a9906d8893529774726ce3c32a5dba2f5e09e111fbd6066228e2639fb758b83a
    .dll 148KB
  • affa2bd8aa9d5e15c7b2b992e4e546bd21c4c40e03aec3cbaef77fc69788f0f8
    .exe 149KB
  • b164588994cade362f326b1bba74af3f0c0a9662adab0bcec720fc659643d540
    .exe 142KB
  • b65b65c3ccf923af7be7db31b3919120e47849cc3e870afdac1bc555fc25b200
    .exe 153KB
  • b964a5253c25465633ef8c2e7f77703d27227bfc0b13a7ca49d187dadc4d38ae
    .exe 159KB
  • b9d3d54532bcc21e9b05754ae0a2f81df5434e4dfd1fcbc840e5466ca38d3060
    .exe 959KB
  • ba0eefdfbd1421d37d47f3feaae8e768a4679d6b544bb97f5237319e8ab0b122
    .exe 153KB
  • bcbdc1bd464ba817632f46bcb5c09a2012da859487c61bd4dc51bceae54512c0
    .exe 163KB
  • c12717c788bbb85092baecbbd2e1d744b0656042dbf335b7c511ba423e2a4681
    .dll 149KB
  • c3230c24b469fe5d82786444d3c7a7d16d78eb65581c814dbc5329a80b65481f
    .exe 959KB
  • c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2
    .exe 159KB
  • c6cf5fd8f71abaf5645b8423f404183b3dea180b69080f53b9678500bab6f0de
    .exe 162KB
  • cc58dcd32a440e7f95d19b653a55c1e2c383efc2bd19443238dd3008c1cbe147
    .exe 142KB
  • cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1
    .exe 148KB
  • d31e38f333deeeb21c8b55fe129b64964a3ff14c04f3149b3f93a56e2fbf33d3
    .exe 159KB
  • d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee
    .exe 162KB
  • de7f501e4a17898e85229b962e2f43b9a20d995c8a9fe0cad4536adc8fbd9f48
    .exe 146KB
  • deca4775a99217b9a8e5e2614f23c20d7d6fa1c13d6b00bad73175a07fe049f1
    .exe 159KB
  • e2a0224a81cf7c568679c751a6e540db172c2310d52ca314000ba97b7dfe3870
    .dll 145KB
  • e80b293b0cecb5265f2a6cc592ee11fea28c3d008fa883781aca1da3f09140b1
    .exe 159KB
  • e8e2deb0a83aebb1e2cc14846bc71715343372103f279d2d1622e383fb26d6ef
    .exe 470KB
  • f41abd588cef0ed3e46f91c73014cc17327200fb41ce2deafaacde023fedfe01
    .exe 147KB
  • f7caf7d69cef15d5c3b9983513e4e40edc3a31c5ead4139bc41d1500442a966a
    .exe 152KB
  • f9dbdb825067616070c64565b6b27dc872c4a7219856eb5f8eb3eb1eb1463423
    .exe 159KB
  • fb4a76c586a12f32ddfb1d5295b2e1f57f4b45a74bb081a60ac4015778ce009c
    .exe 159KB
  • fd3577ff36496320485ffa05681ffa516a56fc4818c3fc89774aa4bb20e2c17f
    .exe 145KB
  • fef1f9664fde9b23754c691b15a05fdc35a51a0ceb8a18fb9a5a0166e6377c69
    .exe 959KB
  • ffbb6c4d8d704a530bdd557890f367ad904c09c03f53fda5615a7208a0ea3e4d
    .exe 191KB

b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24

  • SHA256 b7147a76c6695b750a84de55d4569f71f694b33aeefeef5daa09318ebabd9a24
  • MD5 SHA1 SHA512 SSDEEP

  • Chaos Ransomware

  • Detect Neshta payload

  • Detects command variations typically used by ransomware

  • Rule to detect Lockbit 3.0 ransomware Windows payload