# BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass)

> BlackMatter is a ransomware-as-a-service family first seen in July 2021 and assessed as a possible DarkSide rebrand. Reverse engineering of v2.0 shows RSA-1024 plus modified ChaCha20 file encryption, an aPLib-compressed encrypted config, and a UAC bypass through the ICMLuaUtil COM object.

- **Published:** 2026-11-05T03:56:39Z
- **Last reviewed:** 2026-11-05T03:56:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5291
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5291.png
- **ID:** TL-2026-5291
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** MONITORING
- **Actor:** BlackMatter
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (3 shown free below)

## Description

BlackMatter emerged in late July 2021, shortly after DarkSide and REvil dropped out of public view. Its developers describe it as a combination of LockBit, DarkSide and REvil. Group-IB's analysis points instead to a shared development lineage with DarkSide: both families use an RSA-1024 public key to protect per-file key material, and Group-IB notes that BlackMatter, unlike its predecessors, does not perform CIS-country checks. CISA, the FBI and NSA published joint advisory AA21-291A on 2021-10-18, which assesses BlackMatter as a possible rebrand of DarkSide and maps its behavior to MITRE ATT&CK. Windows and Linux (including ESXi) variants exist, and the group later announced a shutdown citing pressure from authorities.

The Windows v2.0 sample analyzed by Chuong Dong (MD5 50c4970003a84cab1bf2634631fe39d7) hides its behavior with several layers. APIs are resolved dynamically through hash lookup and trampoline calls. Strings are stored as encrypted stack bytes and decrypted by XOR with a constant. Target lists are compared by a one-way hash (sum of bytes rotated right by 13) rather than by literal strings. The configuration is aPLib-compressed and encrypted and carries behavior flags (ENCRYPT_LARGE_FILE_FLAG, CREATE_MUTEX_FLAG, ATTEMPT_LOGON_FLAG, MOUNT_VOL_AND_ENCRYPT_FLAG, NETWORK_ENCRYPT_FLAG, TERMINATE_PROCESSES_FLAG, STOP_SERVICES_AND_DELETE_FLAG, SEND_DATA_TO_SERVER_FLAG, PRINTER_PRINT_RANSOM_NOTE_FLAG). It also carries an RSA public key, a 16-byte AES key for C2 data, a 16-byte company/victim ID, and hashed avoid-lists for folders, files, extensions and computer names. Further fields hold the process-kill list (31 entries), the service-kill list (8 entries), the C2 URL list and the ransom note.

Pre-encryption: if the process is not elevated, it masquerades as dllhost.exe by editing the PEB, calls CoGetObject with the elevation moniker for CLSID {3E5FC7F9-9A51-4367-9063-A120244FBEC7} to obtain ICMLuaUtil, and runs its ShellExec method to relaunch with elevated rights, then terminates the original process. It tries to duplicate the Explorer.exe token and falls back to a svchost.exe token. It can parse supplied credentials in the form username@domain:password and check domain-admin membership. For safe-mode operation (-safe) it sets AutoAdminLogon and the Winlogon credential values, adds a RunOnce entry with a random name, and runs bcdedit /set {current} safeboot network (bootcfg on Windows XP). It deletes Volume Shadow Copies through WMI (SELECT * FROM Win32_ShadowCopy followed by IWbemServices::DeleteInstance), stops and deletes services through the Service Control Manager, kills listed processes, and uses the Restart Manager API to release files held by other processes. It wipes the per-user folders in $RECYCLE.BIN.

Encryption uses an I/O completion port thread pool and a four-state machine, with 1 MiB read chunks and a 132-byte footer holding the RSA-encrypted ChaCha20 matrix and a checksum. The ChaCha20 implementation is a modified version of the CryptoPP SIMD code. Database-type files (.mdf, .ndf, .edb, .mdb, .accdb) are encrypted in chunks. The extension is derived from the victim MachineGuid through three hashing rounds, with Base64 characters replaced (+ to x, / to i, = to z). The ransom note is named <EXTENSION>.README.txt. Network reach comes from Active Directory/LDAP host enumeration and NetShareEnum, skipping IPC$, ADMIN$ and $c$ shares, and from Exchange mailbox paths. A run-once mutex named Global\<MD4(MachineGuid)> prevents double execution. Before encryption the sample POSTs AES-encrypted JSON host metadata (hostname, OS, user, language, disk info) to its C2 using the User-Agent AppleWebKit/587.38 (KHTML, like Gecko), and after encryption it reports file statistics. The -wall switch renders the ransom text to a BMP, sets it as the wallpaper (WallpaperStyle 10) and prints the note on the default printer. Command-line arguments are -path <dir>, -safe and -wall.

Source-bound limits: the source article is from 2021 and no CVEs or CVSS are cited. Severity is analyst-assigned. Initial access, data theft and affiliate tradecraft are not described in the sources reviewed, and no MITRE mapping of intrusion-phase behavior is claimed beyond what the malware analysis shows. BeaconBeagle was unreachable (HTTP 502) during research, so there is no C2 correlation data.

## MITRE ATT&CK

- T1548.002 Bypass User Account Control
- T1134.001 Token Impersonation/Theft
- T1559.001 Component Object Model
- T1036 Masquerading
- T1027.007 Dynamic API Resolution
- T1688 Safe Mode Boot
- T1070.004 File Deletion
- T1547.001 Registry Run Keys / Startup Folder
- T1078.002 Domain Accounts
- T1135 Network Share Discovery
- T1614.001 System Language Discovery
- T1573.001 Symmetric Cryptography
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1491.001 Internal Defacement

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**BlackMatter ICMLuaUtil COM UAC Bypass via DllHost Elevation Moniker — Exploitation** (`TL-2026-5291-SPL-001`)

Detects a child process spawned by the dllhost.exe COM surrogate carrying the ICMLuaUtil CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7. BlackMatter v2.0 (TL-2026-5291) masquerades as dllhost.exe via PEB edit, calls CoGetObject with the Elevation:Administrator!new moniker and runs ICMLuaUtil ShellExec to relaunch itself elevated before terminating the original process. The elevated relaunch is the pre-encryption privilege-escalation step.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1548.002, T1559.001, T1036
- **Data sources:** sysmon, windows_security, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\dllhost.exe" ParentCommandLine="*3E5FC7F9-9A51-4367-9063-A120244FBEC7*" NOT (Image="*\\dllhost.exe" OR Image="*\\conhost.exe")
| eval elevated=if(IntegrityLevel="High" OR IntegrityLevel="System","yes","no")
| table _time host User ParentImage ParentCommandLine Image CommandLine IntegrityLevel elevated Hashes
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'dllhost.exe'
| where InitiatingProcessCommandLine has '3E5FC7F9-9A51-4367-9063-A120244FBEC7'
| where FileName !in~ ('dllhost.exe', 'conhost.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, FolderPath, ProcessCommandLine, ProcessIntegrityLevel, SHA256
```

### Sigma

```yaml
title: BlackMatter ICMLuaUtil COM UAC Bypass via DllHost Elevation Moniker
id: 7c1d3a52-5e0b-4f6a-9a41-2b8e6d0c91f3
status: experimental
description: "Detects a child process launched by the dllhost.exe COM surrogate for CLSID 3E5FC7F9-9A51-4367-9063-A120244FBEC7 (ICMLuaUtil), the auto-elevation UAC bypass used by BlackMatter v2.0 (TL-2026-5291)."
references:
  - https://us-cert.cisa.gov/ncas/alerts/aa21-291a
  - https://www.chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.privilege-escalation
  - attack.t1548.002
  - attack.execution
  - attack.t1559.001
  - attack.defense-evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\dllhost.exe'
    ParentCommandLine|contains: '3E5FC7F9-9A51-4367-9063-A120244FBEC7'
  filter_main:
    Image|endswith:
      - '\dllhost.exe'
      - '\conhost.exe'
  condition: selection and not filter_main
falsepositives:
  - Other tooling that legitimately uses the CMSTPLUA/ICMLuaUtil elevated COM object
  - Software installers that auto-elevate through the same COM class
level: high
```

**Known false positives:**

- Legitimate software or admin tooling that uses the ICMLuaUtil/CMSTPLUA elevated COM object to launch installers
- Red-team or pen-test exercises using UACMe-style COM elevation techniques

**Tuning notes:** Allow-list known installer or management binaries that are legitimately elevated through this CLSID in your estate. Alert at critical severity when the child image runs from a user-writable path (AppData, Temp, Downloads) or carries -path, -safe or -wall arguments.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BlackMatter v2.0 Sample Hash and -path/-safe/-wall Command-Line Execution — Exploitation (locked: unlock with TL Creds)
- BlackMatter Winlogon AutoAdminLogon and Random-Name RunOnce Persistence — Post-Exploitation (locked: unlock with TL Creds)
- BlackMatter SMB Share Fan-Out from Non-System Binary — Lateral Movement (locked: unlock with TL Creds)
- BlackMatter Ransom Note <EXTENSION>.README.txt Creation — Impact (locked: unlock with TL Creds)
- BlackMatter C2 Domain DNS Resolution ([indicator], [indicator]) — C2 (locked: unlock with TL Creds)
- BlackMatter HTTP C2 Beacon via Hardcoded AppleWebKit/587.38 User-Agent — C2 (locked: unlock with TL Creds)
- BlackMatter Safe-Mode Reboot via bcdedit/bootcfg safeboot — Post-Exploitation (locked: unlock with TL Creds)
- BlackMatter Shadow Copy Deletion and Backup Service Stop — Impact Preparation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 16)

Defanged, TLP:CLEAR.

- Domain: `mojobiden[.]com`
- URL: `hxxp://supp24yy6a66hwszu2piygicgwzdtbwftb76htfj7vnip3getgqnzxid[.]onion`
- File hash: `520bd9ed608c668810971dbd51184c6a29819674280b018dc4027bc38fc42e57`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [BlackMatter Ransomware v2.0 (Chuong Dong)](https://www.chuongdong.com/reverse%20engineering/2021/09/05/BlackMatterRansomware/)
- [BlackMatter Ransomware v2.0 (Chuong Dong, mirror)](https://cdong1012.github.io/reverse%20engineering/2021/09/05/BlackMatterRansomware/)
- [CISA/FBI/NSA Advisory AA21-291A: BlackMatter Ransomware](https://us-cert.cisa.gov/ncas/alerts/aa21-291a)
- [CISA, FBI and NSA release BlackMatter ransomware advisory (press release)](https://www.cisa.gov/news/2021/10/18/cisa-fbi-and-nsa-release-blackmatter-ransomware-advisory-help-organizations-reduce)
- [Group-IB: BlackMatter Ransomware analysis](https://www.group-ib.com/blog/blackmatter-ransomware/)
- [BlackBerry: Threat Thursday - BlackMatter Ransomware-as-a-Service](https://blogs.blackberry.com/en/2021/09/threat-thursday-blackmatter-ransomware-as-a-service)
- [Triage sandbox report - BlackMatter sample](https://tria.ge/210906-zvczcaefdp)
- [CloudSEK: BlackMatter Ransomware Specifications Shared on Cybercrime Forum](https://www.cloudsek.com/pt-br/threatintelligence/blackmatter-ransomware-specifications-shared-on-cybercrime-forum)
- [SentinelOne: BlackMatter Ransomware](https://www.sentinelone.com/anthology/blackmatter-ransomware/)
- [Infosecurity Magazine: US Authorities Issue BlackMatter Ransomware Alert](https://www.infosecurity-magazine.com/news/us-authorities-issue-blackmatter/)
- [TechCrunch: BlackMatter ransomware shut down](https://techcrunch.com/2021/11/03/blackmatter-ransomware-shut-down)
- [Security Affairs: BlackMatter ransomware gang is shutting down due to pressure from law enforcement](https://securityaffairs.com/124135/cyber-crime/blackmatter-ransomware-shutting-down-operations.html)
- [Jan G.: API hashing analysis (digital-investigations.info)](https://blog.digital-investigations.info/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5291