BlackMatter Ransomware Technical Analysis and Tools from Nozomi Networks Labs

Over the last weekend, Iowa-based NEW Cooperative Inc. was the latest victim of the ransomware group BlackMatter. According to the company, which operates as a farmers’ cooperative, the incident has been actively handled, but at the time of this writing the full impact of the attack is not clear.

In the media inquiries section of its website, BlackMatter explicitly lists a series of critical infrastructure targets that should not be targeted by its malicious operations. An organization the size of NEW Cooperative could very well be categorized as critical infrastructure. If that’s the case, this attack could have significant consequences. Modern supply chains are sometimes found to be vulnerable to sudden disruptions, with the full effects often understood only much later.

In this blog, we describe the process that Nozomi Networks Labs took to analyze the BlackMatter ransomware executable, as well as ways the malware hinders analysis, and how we were able to overcome them. We provide some scripts that can help other researchers extract key information from other instances of this ransomware that surface in the wild.

Main Functionality

The ransomware encrypts victims’ files with a version of the ChaCha20 and RSA algorithms. RSA is used to ensure that decryption is not possible without the private key stored on the attackers’ side. The malware leaves a note in the form of a README file with the steps to follow to decrypt them. In addition, it changes the wallpaper to bring attention to them:

Wallpaper changed by the BlackMatter ransomware executable, drawing attention to a README file with decryption steps.(Click to enlarge)

In addition, the malware performs various common ransomware actions such as:

• Deleting shadow copies (local backups) by first listing them using WMI query SELECT * FROM Win32_ShadowCopy
• Deleting files in the recycle bin
• Terminating processes and services specified in the configuration
• Changing the wallpaper to point to the README text file for decryption instructions
• Elevation:Administrator!new:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} is used for UAC (user account control) bypass
• Encrypted files will get a new file extension matching the victim id seen in the README file name prefix and also stored in the registry. This victim id is derived from the MachineGuid registry value.

Anti-debugging Techniques

The malware attempts to thwart analysis by hiding which WinAPIs it relies on. To circumvent this, the malware resolves some of the required import functions by their hashes:

To further complicate analysis, in case of bulk WinAPI address resolution by hashes, the malware uses a unique way of storing the addresses found. Instead of just storing them in a table, for every resolved WinAPI address, it randomly chooses one of five different ways to encode it (rol, ror, xor, xor+rol or xor+ror) and stores the encoded address together with a dynamically built code snippet that will decode it just before the call:

Here is one of the result proxy code snippets:

Another anti-debugging trick used by malware is checking the presence of the 0xABABABAB sequence at the end of private heap blocks that it allocates to store these snippets. If the debugger is attached, this sequence will be added and the malware won’t store the address of the snippet in its custom import table, which will later result in the debugged sample crashing.

The strings are commonly decrypted on the fly, just before being used:

With the help of IDAPython functionality, it is possible to automatically find and decrypt most of them:

‍

Configuration

The sample’s encrypted configuration is stored in the .rsrc section, additionally compressed, and the individual fields are base64-encoded. The decrypted C2 configuration can be seen below. The sample can interact with both plain HTTP and HTTPS endpoints as evidenced by the set of C2.

Malware generates random HTTP query values when it communicates with these C2:

To secure communication, the AES algorithm is used.

Here is the extracted configuration:

Overall, there are multiple similarities with the DarkSide ransomware family, including the way the victim id is derived from the MachineGuid value, the encryption techniques used, and the way the configuration is structured and protected. More information on the DarkSide executable can be found in our previous blog.

BlackMatter Ransomware Protection and Indicators of Compromise

Nozomi Networks customers using our Threat Intelligence service are already covered against the described threat. In addition, Nozomi Networks Labs is monitoring this situation as it evolves and will extend coverage to customers and keep the community informed of major updates.

For security professionals defending critical infrastructure operations, general recommendations for cyber resiliency against ransomware is found in our latest OT/IoT Security Report.

For security researchers, the descriptions provided in this blog of how BlackMatter evades analysis, and how to extract key information from the code should be useful as the malware evolves.

The indicators of compromise (IOC) that we learned from this analysis, as well as the scripts we used in the analysis are found below.

List of IOCs

IDAPython Scripts

Here is a script to restore the custom import table dynamically populated by malware. It defines the new hotkey Z that should be pressed when the cursor is located at the bulk decryption function (in case of this sample, at the RVA 0x78EC).

In addition, here is a script to automatically search for and decrypt most of the encrypted strings:

Research Report: Unpacking the OT & IoT Threat Landscape with Unique Telemetry Insight

Read the Nozomi Networks Labs research report from August 2023

View Resource

ABOUT THE AUTHOR

Nozomi Networks Labs

Nozomi Networks Labs is dedicated to reducing cyber risk for the world’s industrial and critical infrastructure organizations. Through our cybersecurity research and collaboration with industry and institutions, we’re helping defend the operational systems that support everyday life.