{"id":47867,"date":"2022-07-25T00:00:00","date_gmt":"2022-07-25T00:00:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/lockbit-ransomware-group-augments-its-latest-variant-lockbit-3-0-with-blackmatter-capabilities-threat-analyst-threats-analyst-threat-analyst-threat-analyst-threat-analyst-threat-analyst\/"},"modified":"2022-07-25T00:00:00","modified_gmt":"2022-07-25T00:00:00","slug":"lockbit-ransomware-group-augments-its-latest-variant-lockbit-3-0-with-blackmatter-capabilities-threat-analyst-threats-analyst-threat-analyst-threat-analyst-threat-analyst-threat-analyst","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/lockbit-ransomware-group-augments-its-latest-variant-lockbit-3-0-with-blackmatter-capabilities-threat-analyst-threats-analyst-threat-analyst-threat-analyst-threat-analyst-threat-analyst\/","title":{"rendered":"LockBit Ransomware Group Augments Its Latest Variant, LockBit 3.0, With BlackMatter Capabilities Threat Analyst Threats Analyst Threat Analyst Threat Analyst Threat Analyst Threat Analyst"},"content":{"rendered":"

<\/p>\n

<\/div>\n
\n
\n

As part of its encryption process, LockBit 3.0 appends the extension HLJkNskOq<\/i> (Figure 3) and changes the icons of encrypted files to that of the aforementioned .ico file.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n

Similarities to BlackMatter ransomware<\/span><\/h2>\n

Researchers have pointed out that portions of LockBit 3.0\u2019s code seem to be borrowed from the BlackMatter ransomware<\/a>, hence the nickname LockBit Black. Likewise, we found similarities between BlackMatter and the new LockBit variant during our debugging of the LockBit 3.0 sample. From our examination of the unpacked sample<\/a> and an analysis provided by the researcher Chuong Dong<\/a>, we discovered that LockBit 3.0 requires a pass parameter to decrypt its main routine (Figure 6). Other ransomware families like Egregor have been observed exhibiting this same behavior, where an argument is required to proceed with the routine. This makes the binary harder to reverse if the parameter is not available.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n

LockBit 3.0 performs API harvesting by hashing the API names of a DLL, and then comparing it to the list of the APIs that the ransomware needs (Figure 7). This routine is identical to that of BlackMatter (Figure 8), as the externally available script<\/a> for renaming BlackMatter\u2019s APIs also works for LockBit 3.0 (Figures 9 and 10). <\/p>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n

Instead of directly calling the addresses of the harvested APIs, LockBit 3.0 implements a trampoline pointer (Figure 11) to go to an allocated heap that contains a disassembly code that will then jump to the API address of the NtTerminateProcess<\/i> API (Figure 12). The code contained in the heap is randomly chosen from this set of codes:<\/p>\n