blackmatter | e038bb439a412f1c98d22a9a4726fbe0747a8bbbb48a8d26ac4dcb039f29e53e

General

Target

2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Size

79KB
MD5

18c7c940bc6a4e778fbdf4a3e28151a8
SHA1

f3589918d71b87c7e764479b79c4a7b485cb746a
SHA256

2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2
SHA512

6e808fe882640a517c2054fdece73059c7ea3e27a946e55f41b91fd0f757dcd8c76be8f381f60f3e45449edebaa4f620b903337727607f7768543b1acec40d18
SSDEEP

1536:+nICS4ArFnRoHhcVyid9EZZoi+zQXFpVX42N:5ZnmqVyq9EN+Mb7

Score

10^/10

blackmatter discovery ransomware

Malware Config

Extracted

Path

F:\n0FF6xtFQ.README.txt

Family

blackmatter

Ransom Note

~+ * + ' BLACK | () .-.,='``'=. - o - '=/_ \ | * | '=._ | \ `=./`, ' . '=.__.=' `=' * + Matter + O * ' . >>> What happens? Your network is encrypted, and currently not operational. We need only money, after payment we will give you a decryptor for the entire network and you will restore all the data. >>> What data stolen? From your network was stolen 250 GB of data. If you do not contact us we will publish all your data in our blog and will send it to the biggest mass media. Blog post link: http://blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion/YdWh7oMKjT/13f1a8efc53e2fa712813f4c39147a79 >>> What guarantees? We are not a politically motivated group and we do not need anything other than your money. If you pay, we will provide you the programs for decryption and we will delete your data. If we do not give you decrypters or we do not delete your data, no one will pay us in the future, this does not comply with our goals. We always keep our promises. >> How to contact with us? 1. Download and install TOR Browser (https://www.torproject.org/). 2. Open http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/5AZHJFLKJNPOJ4F5O5T >> Warning! Recovery recommendations. We strongly recommend you to do not MODIFY or REPAIR your files, that will damage them.

URLs

http://blackmax7su6mbwtcyo3xwtpfxpm356jjqrs34y4crcytpw7mifuedyd.onion/YdWh7oMKjT/13f1a8efc53e2fa712813f4c39147a79

http://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid.onion/5AZHJFLKJNPOJ4F5O5T

Signatures

BlackMatter Ransomware
BlackMatter ransomware group claims to be Darkside and REvil succesor.
ransomware blackmatter
Blackmatter family
blackmatter
Renames multiple (158) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Desktop\WallPaper = "C:\\ProgramData\\n0FF6xtFQ.bmp"	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\n0FF6xtFQ.bmp"	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Desktop	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\Desktop\WallpaperStyle = "10"	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeDebugPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: 36	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeImpersonatePrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeIncBasePriorityPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeIncreaseQuotaPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: 33	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeManageVolumePrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeProfSingleProcessPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeRestorePrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeSecurityPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeSystemProfilePrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeTakeOwnershipPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeShutdownPrivilege	3936	2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
Token: SeBackupPrivilege	3632	vssvc.exe
Token: SeRestorePrivilege	3632	vssvc.exe
Token: SeAuditPrivilege	3632	vssvc.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe
"C:\Users\Admin\AppData\Local\Temp\2e50eb85f6e271001e69c5733af95c34728893145766066c5ff8708dcc0e43b2.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

F:\n0FF6xtFQ.README.txt

Filesize
1KB

MD5
b7f54f12f8d46188c98172cf6c39f91e

SHA1
73f9572f52d54b2cffb8e4464f28453bc3d192b9

SHA256
dedefcd61e8ed1e5a7c8a9469aad4605042ce2eb69c2b20cf6e1ed9b8a14f56d

SHA512
2f0f138db798902990fb4c4cd4f05c66f656a7aef5aa186bad17a39683973c98da392b5207d9ba654a6e2774d920bbf2afea996513e91d159cb87961548374d5

Download Submit
memory/3936-1-0x0000000002D10000-0x0000000002D20000-memory.dmp

Filesize
64KB

Download
memory/3936-0-0x0000000002D10000-0x0000000002D20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing