Overview

overview

10

Static

static

10

BlackMatter-0xb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2025, 00:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BlackMatter-0xb.exe

  • Size

    150KB

  • MD5

    222eab3f409f97b1a3442411676ca689

  • SHA1

    f10f511b30ce28a817a53228adf77a6e4dd80c8f

  • SHA256

    3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61

  • SHA512

    184a2f4696dceb401e9d0b6bbd2747f8dd005e708cd979f8cfffb60c49160ce7f834e29505a194f26ade68e0818683333a7d5dd7fe52f3d9d0469a429c40ed53

  • SSDEEP

    3072:JqJogYkcSNm9V7DMNxr0+4SiK/OKr3qT:Jq2kc4m9tDMr0+4G/d

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\lH0RuaZei.README.txt

Ransom Note
~~~ LockBit 3.0~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything but your money. If you do what we want, we will provide you with a program to decrypt and we will delete your data. Life is too short to be sad. Do not be sad, my request is only easy. If we do not give you the decryption, or we do not delete your data after you do our orders. Therefore, for us your reputation is very important. We attack companies that we have targeted and there are no dissatisfied victims after doing my orders. You can get information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

http://lockbitapt.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlackMatter-0xb.exe
    "C:\Users\Admin\AppData\Local\Temp\BlackMatter-0xb.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1172
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:2000
    • C:\ProgramData\A029.tmp
      "C:\ProgramData\A029.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\A029.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5852
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:5792
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:3348
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{C7EC7EF9-E0F5-40F2-BD78-2E3EE2121BDC}.xps" 133882014384040000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:5824

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3446877943-4095308722-756223633-1000\RRRRRRRRRRR
      Filesize

      129B

      MD5

      af70a3a2f6fdd5bc87c9478b7f55290d

      SHA1

      6ea00d049143d2ee705f93b4b82e0ed1bd202e0b

      SHA256

      05679708390038ee3609a50a4443f87ccd3ba06b30191ac47fd8a14def83748b

      SHA512

      5501aa02da044f31ac51cf2f0e9074eba1d827fc113ba2feed2ac977c66b865ba16e9a91b39085290f11831ebc64e70b7adb771eac7b8673695f357e0f9f6c18

      Download Submit

    • C:\ProgramData\A029.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDD
      Filesize

      150KB

      MD5

      0f93cc067a6a511d19afe96d7d22863c

      SHA1

      1a26e91e4f20ab4429a22e0fd96c354baac89610

      SHA256

      c089bbfad21717cadf00ef923cb3352e4b2f294ad08fb46e71331f8da26f0431

      SHA512

      461f9e5f9d8475e8cda6afe309cb93d3f083c0598c09755e8149de9dd64d2e38534ccc13b5a185494afa5bc80e9758db10096e8c83fe12cde8b8f4add7e72739

      Download Submit

    • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
      Filesize

      4KB

      MD5

      0f24012fe27e15ef58a97b349725c285

      SHA1

      7e3777ab98ceceb07aea97961213cb0aaa48773b

      SHA256

      3a61fd702c0d802e6066525e5448f5b893976556e0010012164aed67e20264cf

      SHA512

      44d559b86d3a65fbe35c5c7ba85316e8c53fb9e8c9df10acc9dcea58d51f849972a3c6ad507969b416417d1f4c9d12acea4fa24cf25903b2368274c0a2dffe6c

      Download Submit

    • C:\lH0RuaZei.README.txt
      Filesize

      3KB

      MD5

      65db5ae077a794215bbdb09d32687b14

      SHA1

      094996df9288f29c43602fa43a0ac33aee7b2848

      SHA256

      1bfdb412aa3f1073218d92b6f81a10fbd764eb96b1cce29aecc6502f19f0a646

      SHA512

      2a138eaea63d3b41fe6539e99edf855463ad0bec8c752aaf43fe4b176186cb2e2b2a29f0f5587761c01fc0d30cdcf1af3d4f0879fc618eb170537c130c92b8a6

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3446877943-4095308722-756223633-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      54cd80b4a94ac04c66765cf5a25deaa7

      SHA1

      4ac48de3017b898cd8a732e08afecb3b43a8a49d

      SHA256

      5c10fe908102b2bbd99314951bc7b91543430fbf106a1ea7fc4d5a5af60a8a61

      SHA512

      ae4b1401c67e20db36a044f6d1bf32e500444633c5c613425ca070f9fd1aa36dbce7b8591903fc6177dfcbef9a29cd1ae0597d1123bd7b87a7fbb4a8ba098b1f

      Download Submit

    • memory/1172-3495-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1172-3494-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1172-1-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1172-3493-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1172-2-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1172-0-0x0000000002720000-0x0000000002730000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5824-3511-0x00007FFB0A1D0000-0x00007FFB0A1E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5824-3513-0x00007FFB0A1D0000-0x00007FFB0A1E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5824-3514-0x00007FFB0A1D0000-0x00007FFB0A1E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5824-3515-0x00007FFB0A1D0000-0x00007FFB0A1E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5824-3512-0x00007FFB0A1D0000-0x00007FFB0A1E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5824-3544-0x00007FFB07870000-0x00007FFB07880000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5824-3545-0x00007FFB07870000-0x00007FFB07880000-memory.dmp

      Filesize

      64KB

      Download