LockBit Ransomware Group Augments Its Latest Variant, LockBit 3.0, With BlackMatter Capabilities

As part of its encryption process, LockBit 3.0 appends the extension HLJkNskOq (Figure 3) and changes the icons of encrypted files to that of the aforementioned .ico file.

The ransomware then drops its ransom note (Figure 4), which references “Ilon Musk” and the European Union’s General Data Protection Regulation (GDPR). Lastly, it changes the wallpaper of the victim’s machine to inform them of the ransomware attack (Figure 5).

Similarities to BlackMatter ransomware

Researchers have pointed out that portions of LockBit 3.0’s code seem to be borrowed from the BlackMatter ransomware, hence the nickname LockBit Black. Likewise, we found similarities between BlackMatter and the new LockBit variant during our debugging of the LockBit 3.0 sample. From our examination of the unpacked sample and an analysis provided by the researcher Chuong Dong, we discovered that LockBit 3.0 requires a pass parameter to decrypt its main routine (Figure 6). Other ransomware families like Egregor have been observed exhibiting this same behavior, where an argument is required to proceed with the routine. This makes the binary harder to reverse if the parameter is not available.

LockBit 3.0 performs API harvesting by hashing the API names of a DLL, and then comparing it to the list of the APIs that the ransomware needs (Figure 7). This routine is identical to that of BlackMatter (Figure 8), as the externally available script for renaming BlackMatter’s APIs also works for LockBit 3.0 (Figures 9 and 10). 

Instead of directly calling the addresses of the harvested APIs, LockBit 3.0 implements a trampoline pointer (Figure 11) to go to an allocated heap that contains a disassembly code that will then jump to the API address of the NtTerminateProcess API (Figure 12). The code contained in the heap is randomly chosen from this set of codes:

• ROR by random number
• ROL by random number
• XOR to key
• ROR by random number, then XOR to key
• ROL by random number, then XOR to key

LockBit 3.0 and BlackMatter also implement the same antidebugging technique: Both set the thread information to ThreadHideFromDebugger (0x11) via the NtSetThreadInformation API (Figure 13) to cause any debuggers to crash if a breakpoint is placed on this thread.

Like BlackMatter, LockBit 3.0 employs threading when using an API instead of directly calling an API, which is likely an attempt to make it more difficult for researchers to analyze. The strings it uses are decrypted using a simple bitwise-XOR routine (Figure 14), a bitwise-XOR and NOT routine (Figure 15), or a decryption routine involving a linear congruential generator (LCG) algorithm to generate a pseudorandom key (Figure 16). This is also similar to how BlackMatter operates, except for the addition of the bitwise-XOR and NOT routine.

Like BlackMatter, LockBit 3.0 also performs these routines:

• Attempts to log in using credentials from its configuration list to determine if the compromised system is a part of the domain admin that it will use for later routines
• Terminates and deletes processes and services from its configuration list, a routine similar to that of BlackMatter
• Wipes the recyle bin folder of every drive
• Checks a list of computer name hashes to avoid from its configuration list
• Connects to the C&C server from its configuration list if the flag is set
• Encrypts network shares and Exchange Mailbox if set in its configuration flag
• Obtains a list of files, folders, and extensions to be avoided from its configuration list
• Uses pointed files when encrypting .lnk files 
• Prints the ransom note on any available printers and modifies the desktop wallpaper
• Uses the same encryption algorithm as BlackMatter

LockBit 3.0’s deletion of shadow copies (Figure 18) is clearly lifted from BlackMatter’s code, as this is performed using Windows Management Instrumentation (WMI) through COM objects, as opposed to LockBit 2.0’s use of vssadmin.exe.

LockBit 3.0 on VirusTotal

A researcher recently spotted another LockBit 3.0 sample on VirusTotal (Figure 21), with 19 detections at the time of this writing. This specific sample is a PowerShell script containing two layers of obfuscated code (Figures 22 and 23). After deobfuscating the script (Figure 24), we found that LockBit 3.0 is capable of injecting a DLL into memory via reflective loading (Figure 25), using code that is identical to BlackMatter’s own PowerShell code (Figure 26).

This particular sample has a payload that is compressed and encrypted via Base64 (Figure 27). To access it, we modified the script to dump the payload instead of executing it (Figure 28). By dumping the payload, we were able to obtain LockBit 3.0’s main binary (Figure 29). 

When it is executed, the script exhibits the same behavior as the previously discovered LockBit 3.0 sample. This specific sample appends 19MqZqZ0s to the file names of encrypted files (Figure 30).

The payload of this specific LockBit 3.0 sample checks for only three hashed arguments (Figure 31), while the previous LockBit 3.0 sample checks for eight. Its DLL payload is reflectively loaded, and the codes of its propagation routine via admin shares and group policy are designed for PE (Portable Executable) binaries, not for a PowerShell script, which might explain why some of the routines don’t work. Another possibility is that LockBit 3.0’s ransomware builder might have the option to disable certain routines. This LockBit 3.0 sample with the PowerShell script doesn’t need a pass “key” to run even if there is a check for the -pass argument, although the rest of its routines are the same as those in the abovementioned sample with a Win32 .exe file.

Locking out ransomware attacks

The LockBit ransomware gang led the ransomware-as-a-service (Raas) scene in the first quarter of 2022, with 220 self-reported successful RaaS and extortion attacks. One headline-making attack reportedly took place in January, during which LockBit operators claimed to have breached France’s Ministry of Justice. It would be no surprise if some of BlackMatter’s affiliates had joined the ranks of the LockBit group, considering LockBit’s recent rise in notoriety, which would explain the many similarities between the two pieces of ransomware.

With the release of this latest variant — and the launch of LockBit’s bug bounty program, which rewards its affiliates — we expect the LockBit ransomware group to be even more active in the coming days. We advise organizations and end users to be wary of this new variant, especially since the bug bounty program might help the operators in making their ransomware an even more formidable one. Best practices for mitigating the risk of a ransomware attack include:

• Following the 3-2-1 rule, which involves backing up files in three copies in two different formats, with one copy stored off-site. This is a precautionary measure to avoid data loss in case of a ransomware attack.
• Remaining vigilant against socially engineered emails to reduce the risk of a ransomware infection, as ransomware is commonly spread through malicious spam email attachments.
• Keeping applications and programs up to date. Regular patching ensures that software vulnerabilities that ransomware actors could exploit as entry points can be addressed in a timely fashion.

Organizations can benefit from a multilayered approach that can help guard possible entry points into a system (endpoint, email, web, and network). Trend Micro offers a suite of security solutions that can detect malicious components and suspicious behavior, and improve an enterprise’s security posture. Trend Micro Vision One™ provides multilayered protection and behavior detection, which helps block suspicious behavior early in a system before a ransomware infection can do irreversible damage. Trend Micro™ Deep Discovery™ Email Inspector uses custom sandboxing and advanced analysis techniques to block malicious emails, including phishing emails that are common entry points for ransomware. Additionally, Trend Micro Apex One™ offers automated threat detection and response to protect endpoints from more advanced concerns such as fileless threats and ransomware.