Analysis
- max time kernel
149s - max time network
132s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
30/11/2025, 02:38
General
- Target 2025-11-30_53cb69a2c6738745134e583cd8f11a37_cobalt-strike_coinminer_dosia_frostygoop_luca-stealer_quasar-rat_sliver_snatch.exe
- Size 4.3MB
- Sample251130-c443vsdr91
- SHA256 ae1b3f5772977a9b026b89d96da72db78b7004648bbb2782bb9936d239319672
Malware Config
Extracted
-
C:\Users\Default\Documents\HOW_RETURN_YOUR_DATA.TXT
-
blacklock
- Your files have been stolen and encrypted by Black Lock Ransomware! Due to a security issue on your network, it was possible for us to gain administrator access to your device(s). Your data has been exported to our servers prior to encryption. You can recover your files and we can delete your files from our servers. However, This will cost you money in cryptocurrency. If you chose not to cooperate with us, your files will remain encrypted forever and they will be published for anyone to abuse on our dark web blog. Many will advise you not to pay our fee, but in the end, you will lose more money by ignoring this attack and getting your files leaked on our dark web blog like some clowns. Additionally, we will make it our priority to make it impossible for you to continue conducting business. This includes, but is not limited to : - Constantly receiving phone calls and e-mails from us - Having your business website shut down - Contacting your clients and letting them know of the security breach - Employee data being sold on the dark web and eventually used to make purchases or open bank accounts If you want to pay the fee, follow these steps : --- Client area (use this site to contact us): Install Tor Browser here : https://www.torproject.org/download/ Link for Tor Browser: Link for Tor Browser: http://4ozbomcjurd64vgeblkoqeqirvawi3dddswriw6qespscmequmqlshyd.onion/3581eb15ba202199385ddf5dc5c8d4fb Start Tor Browser and connect to the Tor network. Visit our Blog: http://zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion When logged into the chat, send us any message to notify us. We will tell you about the decryption fee and after receiving payment in cryptocurrency, we will provide you with the following : - Decryption tool to recover your files - Deleting your files from our servers - Information on how we gained access to your network It is in our best interest to respect our part of the deal, because our reputation is on the line. After all, we are only here for profit."#, id); specifically, this part : ``` Additionally, we will make it our priority to make it impossible for you to continue conducting business. This includes, but is not limited to : - Constantly receiving phone calls and e-mails from us - Having your business website shut down - Contacting your clients and letting them know of the security breach - Employee data being sold on the dark web and eventually used to make purchases or open bank accounts ``` The encryption algorithm we used is AES 256 bits, anyone claiming they can decrypt your files without paying our fee is blatantly lying to you.
-
http://4ozbomcjurd64vgeblkoqeqirvawi3dddswriw6qespscmequmqlshyd.onion/3581eb15ba202199385ddf5dc5c8d4fb
-
http://zdkexsh2e7yihw5uhg5hpsgq3dois2m5je7lzfagij2y6iw5ptl35gyd.onion
Signatures
- BlackLock
BlackLock is a Windows ransomware written in Golang.
- Blacklock family
- Deletes itself 1 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-11-30_53cb69a2c6738745134e583cd8f11a37_cobalt-strike_coinminer_dosia_frostygoop_luca-stealer_quasar-rat_sliver_snatch.exe"C:\Users\Admin\AppData\Local\Temp\2025-11-30_53cb69a2c6738745134e583cd8f11a37_cobalt-strike_coinminer_dosia_frostygoop_luca-stealer_quasar-rat_sliver_snatch.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "$f='C:\Users\Admin\AppData\Local\Temp\2025-11-30_53cb69a2c6738745134e583cd8f11a37_cobalt-strike_coinminer_dosia_frostygoop_luca-stealer_quasar-rat_sliver_snatch.exe';while(Test-Path -Path $f){$o=new-object byte[] 10485760;(new-object Random).NextBytes($o);[IO.File]::WriteAllBytes($f,$o);Remove-Item -Path $f;Sleep 1;}"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_t4nbxkvv.c01.ps1
ApproveGrant.odp.busy
HOW_RETURN_YOUR_DATA.TXT
memory/1564-414-0x000000C000000000-0x000000C000400000-memory.dmp
memory/1564-415-0x000000C000000000-0x000000C000400000-memory.dmp
memory/1564-416-0x000000C000000000-0x000000C000400000-memory.dmp
memory/1564-417-0x000000C000000000-0x000000C000400000-memory.dmp
memory/1564-418-0x000000C000000000-0x000000C000400000-memory.dmp
memory/4552-420-0x000002A080180000-0x000002A080190000-memory.dmp
memory/4552-419-0x000002A080180000-0x000002A080190000-memory.dmp
memory/4552-427-0x000002A0FDAE0000-0x000002A0FDB02000-memory.dmp
memory/4552-428-0x000002A080180000-0x000002A080190000-memory.dmp