Analysis

  • max time kernel
    153s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    11/02/2024, 19:30

General

  • Target

    LometuBetax.exe

  • Size

    139.9MB

  • MD5

    ec75e78a0d86c9653aa95a49bc5b6a53

  • SHA1

    1d3ae6aba8748cab4bc2b33f3777eba4a025c155

  • SHA256

    10a36e7241a8ef76f98270745fc76979020741ef22601daa605cedb043c06b2b

  • SHA512

    bd895e0218aed1b113db52fbee0df22c8a0b50758d3154d48384f14be58af175f14d47d63732e0773c59975e6b43894f67f80e0a0cad7f1d0cf96e2f77e404ca

  • SSDEEP

    1572864:E2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:7aodJFek8+k

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
    "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
      "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1304,i,3739532009233683187,17786177823467958222,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2808
      • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
        "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1544 --field-trial-handle=1304,i,3739532009233683187,17786177823467958222,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        PID:568
      • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
        "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --mojo-platform-channel-handle=1388 --field-trial-handle=1304,i,3739532009233683187,17786177823467958222,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:268
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1956
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2504
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2180
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
            3⤵
              PID:2192
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1612
            • C:\Windows\system32\reg.exe
              C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
              3⤵
                PID:2512
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
              2⤵
                PID:1788
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1900
              • C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe
                "C:\Users\Admin\AppData\Local\Temp\LometuBetax.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Video game" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1316 --field-trial-handle=1304,i,3739532009233683187,17786177823467958222,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
                2⤵
                  PID:2968
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                  2⤵
                    PID:1740
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      3⤵
                      • Detects videocard installed
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2172
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                    2⤵
                      PID:2396
                      • C:\Windows\system32\cmd.exe
                        cmd /c chcp 65001
                        3⤵
                          PID:2248
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            4⤵
                              PID:1908
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profiles
                            3⤵
                              PID:2264
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
                            2⤵
                              PID:2864
                              • C:\Windows\system32\reg.exe
                                C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
                                3⤵
                                • Adds Run key to start application
                                PID:2600
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                              2⤵
                                PID:2792
                                • C:\Windows\system32\tasklist.exe
                                  tasklist
                                  3⤵
                                  • Enumerates processes with tasklist
                                  PID:2232

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Antivirus.txt

                              Filesize

                              231B

                              MD5

                              dec2be4f1ec3592cea668aa279e7cc9b

                              SHA1

                              327cf8ab0c895e10674e00ea7f437784bb11d718

                              SHA256

                              753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                              SHA512

                              81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                            • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

                              Filesize

                              249B

                              MD5

                              cf7e4a12f932a3fddddacc8b10e1f1b0

                              SHA1

                              db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

                              SHA256

                              1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

                              SHA512

                              fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

                            • C:\Users\Admin\AppData\Roaming\Video game\Local Storage\leveldb\CURRENT~RFf769203.TMP

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • \Users\Admin\AppData\Local\Temp\26b039f6-5ba1-441a-ac46-26d143ae5bfa.tmp.node

                              Filesize

                              641KB

                              MD5

                              09927c3eecd16460b55c73c413a8f528

                              SHA1

                              1c7d39c0d0a2ad92071053220ee5324e45b68612

                              SHA256

                              d98a874efe2b94e856d67197f2069ab51bb29927177e516323c8f8f465686e14

                              SHA512

                              2504946705941cca8ab579089c187268f801899c8190cf0f3b69e22208ad138f14bad822e403a755c3e74fbe4ad38278f11875c4e069a9074f9fe31c3028d380

                            • \Users\Admin\AppData\Local\Temp\568ce9e0-e312-4e6e-9005-0bf9dd2c5d08.tmp.node

                              Filesize

                              2.7MB

                              MD5

                              34338c8a774bc30c223f228b3ef394bb

                              SHA1

                              98ae6592b53d35261b1a122d5b60bea7a8d8fb96

                              SHA256

                              d868ca7a24ce77b9ed0d78ce2e75e85f7c342888def0b8d65a9a965b81d3e1ab

                              SHA512

                              b728b18adc32111c53210282dae660fea7bab66e6dee4ae62f8761e5e8cb1ff4db3420a04d861a60949221d8611b0fa0d02d4963ae1a3d338d0f7f4af20a90f7

                            • memory/2808-5-0x0000000000860000-0x0000000000861000-memory.dmp

                              Filesize

                              4KB

                            • memory/2808-60-0x0000000076DD0000-0x0000000076DD1000-memory.dmp

                              Filesize

                              4KB

                            • memory/3064-29-0x0000000002550000-0x0000000002551000-memory.dmp

                              Filesize

                              4KB