BlackMatter Ransomware: Descendant of DarkSide?

On July 21st, 2021, a new ransomware group named BlackMatter appeared on the DarkWeb exploit forum, which is assumed to be operated in Russia. According to its author, BlackMatter ransomware was made by combining features of previously well-known ransomware: DarkSide, BlueCrab, and LockBit. Some surmise that the organization is actually the DarkSide group that disappeared after the attack on the U.S. Colonial Pipeline.

This post will analyze the characteristics, damage, and attack process of BlackMatter ransomware.  

BlackMatter group first appeared to be active in August 2021, distributing ransomware to 28 organizations till early October.

The group recruited attackers through DarkWeb and distributed ransomware and stoled sensitive data with targeted attacks on particular companies by taking control of their internal infrastructure, showing similar aspects to other groups that recently distributed ransomware. As for companies that do not pay the ransom, the threat group leaks their names and stolen data on the data leak site run by the group.

Characteristics 

The major characteristic of BlackMatter ransomware is that the organization stated they would not attack critical infrastructures, such as hospitals, nuclear power plants, and hydroelectric power plants, as well as, oil and gas industry, defense industry, non-profit organizations, and government sectors. It appears that they are well-aware of the attack on the US Colonial Pipeline led by the DarkSide ransomware group on May 2021. The group was known to lose all of their profits and operational infrastructure as both the FBI and the U.S. government actively intervened in the incident.

Figure 1. Rules posted by BlackMatter group 

BlackMatter stated that if a company that falls under the mentioned category is infected by a mistake, they will provide the decrypter tool for free.

Damage and Major Cases 

As of October 2021, there are a total of 28 companies globally that were attacked by BlackMatter ransomware. Figure 2 and Figure 3 show attack cases by industry and by country. The ransomware's data leak site and press release were used as references to create the statistics. 

Figure 2. BlackMatter ransomware attack cases by industry

Figure 3. BlackMatter attack cases by country

Major Case: Olympus

Olympus, headquartered in Japan​, is a global big business specializing in manufacturing medical precision instruments.

Figure 4. Press release regarding BlackMatter ransomware incident in Olympus

On September 8th, 2021, all networks of Olympus subsidiaries in Europe, Middle East, and Africa were ceased due to a massive ransomware attack. Regarding this attack, the company announced a statement that "an investigation for the cyber security incident is currently in progress." According to a company insider, a ransom note suspected to belong to the BlackMatter ransomware group was found. 

Attack Analysis 

Table 1 shows a sample of BlackMatter ransomware used by AhnLab for the analysis. 

Table 1. Information of BlackMatter ransomware sample 

Analysis of BlackMatter ransomware's attack method will be explained in the order of the attack.

1. Checking process privilege and UAC Bypass

When BlackMatter ransomware is executed for the first time, it executes a code that checks the privilege of the current process. If the process is a user privilege, the code escalates privilege via UAC Bypass. If the process is an administrator's privilege, the function for the action stops.

dllhost.exe string is created when the obfuscated data is unobfuscated. Then "Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}" string is created along with the entire path of the executable (see Figure 5).

Figure 5. Creating string

When CoGetObject and ObjectStublessClient9 functions are called, dllhost.exe is executed (see Figure 6) and BlackMatter ransomware file is executed as a child process. Privilege escalation occurs at this point, and this technique is called "UAC Bypass," which uses CMSTPLUA COM Interface. 

Figure 6. Privilege escalation via UAC Bypass 

2. Code branching by command argument

Next, the command arguments are parsed (parsing: analyzing the component of strings) using CommandLineToArgvW function. The delivered parameter strings go through comparison operations with the hash values hard-coded by the ransomware sample's own hash functions. The codes are branched depending on the parameters (see Figure 7).

Figure 7. Code branching by command argument values

BlackMatter ransomware executes different codes depending on the command argument. For detailed explanation, see Table 2. 

Table 2. Code branching by command arguments 

3. Preventing concurrent execution of processes

The BlackMatter custom hash operation is processed using the system GUID value. Then a mutex (mutual exclusion) of a random name that is effective only for the current system is created with XOR operation (hard-coded value). The mutex prevents the concurrent execution of processes.

Figure 8. Preventing concurrent execution of processes

The following is the created mutex string.

▶Global\0c111f6a663f88b095d9e4f755e54840)

4. Collecting system information and creating JSON data

After collecting the host information and disk information of the current system, BlackMatter ransomware creates the data structure in JSON format (see Figure 9).

Figure 9. Collecting system host and disk information, and creating JSON data

BotID is created in a method similar to the algorithm creating a mutex string, which is added to the data structure in JSON format that was created earlier.

Figure 10. Adding JSON data value (BotID)

5. Encrypting collected information (JSON Data) by AES and sending it to C2

The information collected in the JSON data format is encrypted by AES (Advanced Encryption Standard). The AES Key hard-coded inside the sample file is used for the process. The encrypted data or collected information is sent to the attacker server (C2) via HttpOpenRequestW and HttpSendRequestW functions after it is encoded with Base64.

Figure 11. Sending encrypted data (collected information) to C2

6. Terminating processes that disrupt ransomware

BlackMatter ransomware finds SYSTEM_PROCESS_INFORMATION struct using "ZwQuerySystemInformation" function and parses internal members. It then compares each process with the processes that are targeted to be terminated in Table 3 and terminates processes using NtOpenProcess and ZwTerminateProcess functions.

Figure 12. Terminating processes that disrupt ransomware 

Table 3. List of processes that are terminated​

7. Removing services that disrupt ransomware

After finding all services installed in the system using OpenSCManager and EnumServicesStatusExW functions, the sample searches for services (services that include strings shown in Table 4) that disrupt ransomware. It then removes confirmed services using DeleteService function.

 Figure 13. Searching for services that need to be removed 

Table 4. Strings that need to be removed

8. Searching directory, creating ransom note, and encrypting files

After removing services that disrupt ransomware, the sample executes the directory search loop range using FindFirstFileExW and FindNextFileExW functions. Directories in Table 5 are exempt from access. Ransom notes are created in every searched directory, then the files are encrypted, but some files from Table 6 and files that have extensions from Table 7 are not encrypted.

 Figure 14. Searching directories and encrypting files

Table 5. Names of folders exempt from access 

Table 6. List of files exempt from encryption ​

Table 7. List of extensions exempt from encryption

The files are encrypted by Salsa20 using the key created by the code that generates a random value (see Figure 15). The key used in the encryption is additionally encrypted by RSA.

Figure 15. Creating random key value > Salsa20 encryption key

Figure 16 and 17 show the samples of encrypted files and image of the ransom note file respectively.

Figure 16. Encrypted file samples

Figure 17. Ransom note

9. Changing desktop and registering auto-run registry

The ransomware sample creates a desktop file after encrypting all available files (see Figure 18). It also creates a key value of the auto-run registry with the name *RYL415ver in the registry path of "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce."

Figure 18. Changing desktop image to a ransom note

Figure 19. Registering auto-run registry

AhnLab V3 detects and blocks BlackMatter ransomware using the following alias and engine version information:

▶Ransomware/Win.BlackMatter C4575089(2021.08.04.03)

​ 

Conclusion 

As BlackMatter ransomware appeared out of the blue after the attacks of the DarkSide ransomware group's operation had stopped, some suspect that the same attacker is behind the two groups. But the technical analysis of the attack method shows that while some features are indeed similar, it cannot be said for certain that the source code of BlackMatter ransomware is similar to that of DarkSide. The result of binary analysis also suggests that the attacker of BlackMatter is not the same as that of DarkSide.

BlackMatter Ransomware has allegedly announced that it is shutting down its operation due to pressures from the authorities as of early November. The ransomware group has also announced plans to shut down its ransomware-as-a-service(RaaS) portal, which provides BlackMatter ransomware strain to other threat groups. However, like that of many other ransomware groups, it is uncertain if this will be a permanent exit or simply another rebrand. Let us hope it’s the former.