Analysis

  • max time kernel
    164s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/02/2024, 19:30

General

  • Target

    LometuBetax.exe

  • Size

    139.9MB

  • MD5

    ec75e78a0d86c9653aa95a49bc5b6a53

  • SHA1

    1d3ae6aba8748cab4bc2b33f3777eba4a025c155

  • SHA256

    10a36e7241a8ef76f98270745fc76979020741ef22601daa605cedb043c06b2b

  • SHA512

    bd895e0218aed1b113db52fbee0df22c8a0b50758d3154d48384f14be58af175f14d47d63732e0773c59975e6b43894f67f80e0a0cad7f1d0cf96e2f77e404ca

  • SSDEEP

    1572864:E2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:7aodJFek8+k

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
    "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
      "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1844,i,15133092114315417036,13919190861883653914,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:1600
      • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
        "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --mojo-platform-channel-handle=2160 --field-trial-handle=1844,i,15133092114315417036,13919190861883653914,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:2300
        • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
          "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2432 --field-trial-handle=1844,i,15133092114315417036,13919190861883653914,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
          2⤵
          • Checks computer location settings
          PID:456
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
          2⤵
            PID:4928
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
              3⤵
                PID:4524
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
              2⤵
                PID:1220
                • C:\Windows\system32\reg.exe
                  C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
                  3⤵
                    PID:1276
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                  2⤵
                    PID:4160
                    • C:\Windows\system32\tasklist.exe
                      tasklist
                      3⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4220
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
                    2⤵
                      PID:2952
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3528
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                      2⤵
                        PID:2600
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic path win32_VideoController get name
                          3⤵
                          • Detects videocard installed
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2944
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                        2⤵
                          PID:3692
                          • C:\Windows\system32\cmd.exe
                            cmd /c chcp 65001
                            3⤵
                              PID:3556
                              • C:\Windows\system32\chcp.com
                                chcp 65001
                                4⤵
                                  PID:4680
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profiles
                                3⤵
                                  PID:1268
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
                                2⤵
                                  PID:1252
                                  • C:\Windows\system32\taskkill.exe
                                    taskkill /IM chrome.exe /F
                                    3⤵
                                    • Kills process with taskkill
                                    PID:3236
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
                                  2⤵
                                    PID:3968
                                    • C:\Windows\system32\reg.exe
                                      C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
                                      3⤵
                                      • Adds Run key to start application
                                      PID:3068
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                                    2⤵
                                      PID:3212
                                      • C:\Windows\system32\tasklist.exe
                                        tasklist
                                        3⤵
                                        • Enumerates processes with tasklist
                                        PID:3808
                                    • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
                                      "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1032 --field-trial-handle=1844,i,15133092114315417036,13919190861883653914,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4392

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\1923808e-68d0-4a88-8752-0c25fdc54438.tmp.node

                                    Filesize

                                    2.4MB

                                    MD5

                                    b6a4528f95cfca50e6ce89dda77d9c58

                                    SHA1

                                    2a50be32a8dfb705d070868d21af0de132717545

                                    SHA256

                                    1476c11068802ab30f549daec0be33dcbc2c2f1cb5e274f46cca31d2648ac8ee

                                    SHA512

                                    67e2abfea34e4318e15a0b531e5d06fb5c61b2553450799d2be8da8cccfb0f8dd163ed241885575934b5728697b7ce6c3fcfc3700314640cb5e6a3ea5ed68e01

                                  • C:\Users\Admin\AppData\Local\Temp\4495e726-4691-41d3-b991-0bcaf8367589.tmp.node

                                    Filesize

                                    98KB

                                    MD5

                                    65d301e0c6f7b9c4547ac99f991420c3

                                    SHA1

                                    31bd8eb96990781388d2dd82b19eb6718d21be92

                                    SHA256

                                    68bd7c4e5bd0b748c4d11c1eeb2bf56c1b36eaec1a1c193b6f84b1ce5baf8866

                                    SHA512

                                    f488534a99594e9c427cf17e78079b4c41b317d81a4b590c7f7a0e703cd601c2e06b4a106689a063c079eb5b41e6d9bbe65eb16fb3199adc23c536441f5676ba

                                  • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

                                    Filesize

                                    249B

                                    MD5

                                    cf7e4a12f932a3fddddacc8b10e1f1b0

                                    SHA1

                                    db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

                                    SHA256

                                    1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

                                    SHA512

                                    fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

                                  • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Passwords\All Passwords.txt

                                    Filesize

                                    231B

                                    MD5

                                    dec2be4f1ec3592cea668aa279e7cc9b

                                    SHA1

                                    327cf8ab0c895e10674e00ea7f437784bb11d718

                                    SHA256

                                    753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                                    SHA512

                                    81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                    Filesize

                                    2B

                                    MD5

                                    f3b25701fe362ec84616a93a45ce9998

                                    SHA1

                                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                    SHA256

                                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                    SHA512

                                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                  • C:\Users\Admin\AppData\Roaming\Video game\Network\Network Persistent State

                                    Filesize

                                    296B

                                    MD5

                                    c34f489d13ffce251a3358672d9d4833

                                    SHA1

                                    6579c95bded7c516d5b19584c13270dba8988582

                                    SHA256

                                    380d5f1ec7a56095fc41ece52b3e5ac1c4b20df135f9498b534d349b551cc9a4

                                    SHA512

                                    3c192b378dede2db9187c30b6f2868c0064072c513296ebdb581e898c60299284466664f0dd4c4c8dca7fecefde25b53184e9552194679770d73fe7f38637a15

                                  • C:\Users\Admin\AppData\Roaming\Video game\Network\Network Persistent State~RFe593bf6.TMP

                                    Filesize

                                    59B

                                    MD5

                                    2800881c775077e1c4b6e06bf4676de4

                                    SHA1

                                    2873631068c8b3b9495638c865915be822442c8b

                                    SHA256

                                    226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                    SHA512

                                    e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                  • memory/456-25-0x00007FFA3F1B0000-0x00007FFA3F1B1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/456-41-0x00007FFA409C0000-0x00007FFA409C1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/1600-6-0x00007FFA400C0000-0x00007FFA400C1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-131-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-132-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-133-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-138-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-137-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-139-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-141-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-140-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-143-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB

                                  • memory/4392-142-0x0000029C334E0000-0x0000029C334E1000-memory.dmp

                                    Filesize

                                    4KB