Overview

overview

10

Static

static

10

BlackMatter-0xb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/04/2025, 01:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BlackMatter-0xb.exe

  • Size

    150KB

  • MD5

    222eab3f409f97b1a3442411676ca689

  • SHA1

    f10f511b30ce28a817a53228adf77a6e4dd80c8f

  • SHA256

    3e239b8776d380eb691c859a376977409546903eba4ecd02dba754bbf7d6db61

  • SHA512

    184a2f4696dceb401e9d0b6bbd2747f8dd005e708cd979f8cfffb60c49160ce7f834e29505a194f26ade68e0818683333a7d5dd7fe52f3d9d0469a429c40ed53

  • SSDEEP

    3072:JqJogYkcSNm9V7DMNxr0+4SiK/OKr3qT:Jq2kc4m9tDMr0+4G/d

Score
10/10
defense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\lH0RuaZei.README.txt

Ransom Note
~~~ LockBit 3.0~~~ >>>> Your data are stolen and encrypted The data will be published on TOR website if you do not pay the ransom Links for Tor Browser: http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion Links for the normal browser http://lockbitapt.uz http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly >>>> What guarantees that we will not deceive you? We are not a politically motivated group and we do not need anything but your money. If you do what we want, we will provide you with a program to decrypt and we will delete your data. Life is too short to be sad. Do not be sad, my request is only easy. If we do not give you the decryption, or we do not delete your data after you do our orders. Therefore, for us your reputation is very important. We attack companies that we have targeted and there are no dissatisfied victims after doing my orders. You can get information about us on twitter https://twitter.com/hashtag/lockbit?f=live >>>> You need contact us and decrypt one file for free on these TOR sites with your personal DECRYPTION ID Download and install TOR Browser https://www.torproject.org/ Write to a chat and wait for the answer, we will always answer you. Sometimes you will need to wait for our answer because we attack many companies. Links for Tor Browser: http://lockbitsupt7nr3fa6e7xyb73lk6bw6rcneqhoyblniiabj4uwvzapqd.onion http://lockbitsupuhswh4izvoucoxsbnotkmgq6durg7kficg6u33zfvq3oyd.onion http://lockbitsupn2h6be2cnqpvncyhj4rgmnwn44633hnzzmtxdvjoqlp7yd.onion Link for the normal browser http://lockbitsupp.uz If you do not get an answer in the chat room for a long time, the site does not work and in any other emergency, you can contact us in jabber or tox. Tox ID LockBitSupp: 3085B89A0C515D2FB124D645906F5D3DA5CB97CEBEA975959AE4F95302A04E1D709C3C4AE9B7 XMPP (Jabber) Support: [email protected] [email protected] >>>> Your personal DECRYPTION ID: B7568014A48684D6D525F3F3722638C4 >>>> Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems! >>>> Warning! If you do not pay the ransom we will attack your company repeatedly again!
URLs

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion

http://lockbitapt.uz

http://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd.onion.ly

http://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd.onion.ly

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion.ly

http://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd.onion.ly

http://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd.onion.ly

http://lockbitaptjpikdqjynvgozhgc6bgetgucdk5xjacozeaawihmoio6yd.onion.ly

http://lockbitaptq7ephv2oigdncfhtwhpqgwmqojnxqdyhprxxfpcllqdxad.onion.ly

http://lockbitaptstzf3er2lz6ku3xuifafq2yh5lmiqj5ncur6rtlmkteiqd.onion.ly

http://lockbitaptoofrpignlz6dt2wqqc5z3a4evjevoa3eqdfcntxad5lmyd.onion.ly

https://twitter.com/hashtag/lockbit?f=live

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlackMatter-0xb.exe
    "C:\Users\Admin\AppData\Local\Temp\BlackMatter-0xb.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4360
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
      • Drops file in System32 directory
      PID:3972
    • C:\ProgramData\8369.tmp
      "C:\ProgramData\8369.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\8369.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3824
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:5344
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Suspicious use of WriteProcessMemory
      PID:4640
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{FD569C1D-D62A-4FAB-A650-EEAD8642568D}.xps" 133882037847680000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of SetWindowsHookEx
        PID:4684

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\$Recycle.Bin\S-1-5-21-3446877943-4095308722-756223633-1000\AAAAAAAAAAA
      Filesize

      129B

      MD5

      a6b591027337cdc25f7de79c0861f51c

      SHA1

      e20927dd4c1b57dd28a9fa0136c6f998bb243d4c

      SHA256

      34dbb72edd38a618fb04874781f9720571b4740269fb93b2f7351886432867f0

      SHA512

      2fd78cf94068ed98e18ade34d0182eece7356a2b443c8f5873761a6589d4628eac148c0b0aa183cebc3908645ce18c04c663a32b2124cd369f55d96065e0f7f7

      Download Submit

    • C:\ProgramData\8369.tmp
      Filesize

      14KB

      MD5

      294e9f64cb1642dd89229fff0592856b

      SHA1

      97b148c27f3da29ba7b18d6aee8a0db9102f47c9

      SHA256

      917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

      SHA512

      b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\CCCCCCCCCCCCCCCCCCC
      Filesize

      150KB

      MD5

      b6a0343b8f2ee31efb52875d554dba09

      SHA1

      c8b35dcdd0ef83e2c5e45d83260c348110e804e0

      SHA256

      e959b4e84a0186a2a93a815a6b975f35b8a6a57aa991e793138b00120023af09

      SHA512

      4e7a756ea7e947af87b91f1bea1e335a58ac52497f8061b9792a008a65ece343b0298455b88804eb73e3e542b15bb24880d6eb798d7f349bfb2e2e0876717709

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{465704E2-7129-492A-82BC-0787B7B8F39E}
      Filesize

      4KB

      MD5

      6bc8ad50de36dd1993b6eac17042f26c

      SHA1

      8a6c81f9be7f4b8e1809a16c430e31599be91d17

      SHA256

      46ae30456fcaeaeb087cac548c3786bcea48f1f644d45d0023120bb493946b8b

      SHA512

      5e5090444114f3767c410dcfe27a930b6a928a8e62a01782e074ed624088ae45d78ae392a1316dbbf4176151d2bc154808f9564e37108117eaf017689329544f

      Download Submit

    • C:\lH0RuaZei.README.txt
      Filesize

      3KB

      MD5

      65db5ae077a794215bbdb09d32687b14

      SHA1

      094996df9288f29c43602fa43a0ac33aee7b2848

      SHA256

      1bfdb412aa3f1073218d92b6f81a10fbd764eb96b1cce29aecc6502f19f0a646

      SHA512

      2a138eaea63d3b41fe6539e99edf855463ad0bec8c752aaf43fe4b176186cb2e2b2a29f0f5587761c01fc0d30cdcf1af3d4f0879fc618eb170537c130c92b8a6

      Download Submit

    • F:\$RECYCLE.BIN\S-1-5-21-3446877943-4095308722-756223633-1000\DDDDDDDDDDD
      Filesize

      129B

      MD5

      c8944fc0f6a12b7eaa93d2bc0d15e7cf

      SHA1

      4dbd1f1edb0c86fb0102672afd88f662af10b0d8

      SHA256

      f71815bcdbebc1a5295968fff412b1df92f7d69783061469b4412f134291e8bf

      SHA512

      d9bb99e0ff550f4dbe6cdfa23ecf91c4996b5875d0569c35e944a24f7359c68491afcce8b35587605509bc93cd912477c9182ca4f59f4271b8dd43a6e25c725d

      Download Submit

    • memory/4360-3441-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4360-3440-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4360-2-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4360-3439-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4360-0-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4360-1-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4684-3454-0x00007FFDA07F0000-0x00007FFDA0800000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4684-3456-0x00007FFDA07F0000-0x00007FFDA0800000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4684-3460-0x00007FFDA07F0000-0x00007FFDA0800000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4684-3459-0x00007FFDA07F0000-0x00007FFDA0800000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4684-3455-0x00007FFDA07F0000-0x00007FFDA0800000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4684-3462-0x00007FFD9E360000-0x00007FFD9E370000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4684-3491-0x00007FFD9E360000-0x00007FFD9E370000-memory.dmp

      Filesize

      64KB

      Download