Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3bomelugame...me.exe
windows7-x64
7bomelugame...me.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1LomebuGame.exe
windows7-x64
1LomebuGame.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/af.ps1
windows7-x64
1locales/af.ps1
windows10-2004-x64
1locales/uk.ps1
windows7-x64
1locales/uk.ps1
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows7-x64
3Resubmissions
27/04/2024, 19:36
240427-ybnfasfc9t 727/04/2024, 19:12
240427-xwpy7afb2v 727/04/2024, 18:20
240427-wy4ppaed6x 7Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 18:20
Static task
static1
Behavioral task
behavioral1
Sample
bomelugame/LomebuGame.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
bomelugame/LomebuGame.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
LomebuGame.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral14
Sample
LomebuGame.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
locales/af.ps1
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral23
Sample
locales/af.ps1
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
locales/uk.ps1
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral25
Sample
locales/uk.ps1
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
resources/elevate.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral27
Sample
resources/elevate.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
windows7-x64
General
-
Target
LomebuGame.exe
-
Size
152.7MB
-
MD5
88719f2009bf17f5be9713212f520ab4
-
SHA1
0b843803935d15ff0179cbc83a66768eed88f381
-
SHA256
cde6587e39b95f9debf34ce7c2af0932c8711597fc81609f4d300e63b2fe39dd
-
SHA512
c1fa450234e5571d4c6cfa4a19e7ef5859bcf2300a25462e9eb16198618b9dfdcdb1f15fce309571de58c38c1107c26ad47a65d03eaf1e72ec538b0410784b0b
-
SSDEEP
1572864:gLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:gypCmJctBjj2+Jv
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 4628 LomebuGame.exe 4628 LomebuGame.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ipinfo.io -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1692 powershell.exe 3992 powershell.exe 1344 powershell.exe 1692 powershell.exe 3992 powershell.exe 1344 powershell.exe 2700 LomebuGame.exe 2700 LomebuGame.exe 3724 LomebuGame.exe 3724 LomebuGame.exe 3724 LomebuGame.exe 3724 LomebuGame.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1692 powershell.exe Token: SeDebugPrivilege 3992 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeIncreaseQuotaPrivilege 3992 powershell.exe Token: SeSecurityPrivilege 3992 powershell.exe Token: SeTakeOwnershipPrivilege 3992 powershell.exe Token: SeLoadDriverPrivilege 3992 powershell.exe Token: SeSystemProfilePrivilege 3992 powershell.exe Token: SeSystemtimePrivilege 3992 powershell.exe Token: SeProfSingleProcessPrivilege 3992 powershell.exe Token: SeIncBasePriorityPrivilege 3992 powershell.exe Token: SeCreatePagefilePrivilege 3992 powershell.exe Token: SeBackupPrivilege 3992 powershell.exe Token: SeRestorePrivilege 3992 powershell.exe Token: SeShutdownPrivilege 3992 powershell.exe Token: SeDebugPrivilege 3992 powershell.exe Token: SeSystemEnvironmentPrivilege 3992 powershell.exe Token: SeRemoteShutdownPrivilege 3992 powershell.exe Token: SeUndockPrivilege 3992 powershell.exe Token: SeManageVolumePrivilege 3992 powershell.exe Token: 33 3992 powershell.exe Token: 34 3992 powershell.exe Token: 35 3992 powershell.exe Token: 36 3992 powershell.exe Token: SeIncreaseQuotaPrivilege 1344 powershell.exe Token: SeSecurityPrivilege 1344 powershell.exe Token: SeTakeOwnershipPrivilege 1344 powershell.exe Token: SeLoadDriverPrivilege 1344 powershell.exe Token: SeSystemProfilePrivilege 1344 powershell.exe Token: SeSystemtimePrivilege 1344 powershell.exe Token: SeProfSingleProcessPrivilege 1344 powershell.exe Token: SeIncBasePriorityPrivilege 1344 powershell.exe Token: SeCreatePagefilePrivilege 1344 powershell.exe Token: SeBackupPrivilege 1344 powershell.exe Token: SeRestorePrivilege 1344 powershell.exe Token: SeShutdownPrivilege 1344 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeSystemEnvironmentPrivilege 1344 powershell.exe Token: SeRemoteShutdownPrivilege 1344 powershell.exe Token: SeUndockPrivilege 1344 powershell.exe Token: SeManageVolumePrivilege 1344 powershell.exe Token: 33 1344 powershell.exe Token: 34 1344 powershell.exe Token: 35 1344 powershell.exe Token: 36 1344 powershell.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe Token: SeCreatePagefilePrivilege 4628 LomebuGame.exe Token: SeShutdownPrivilege 4628 LomebuGame.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 4628 wrote to memory of 3204 4628 LomebuGame.exe 86 PID 4628 wrote to memory of 3204 4628 LomebuGame.exe 86 PID 3204 wrote to memory of 4624 3204 cmd.exe 88 PID 3204 wrote to memory of 4624 3204 cmd.exe 88 PID 4628 wrote to memory of 4924 4628 LomebuGame.exe 89 PID 4628 wrote to memory of 4924 4628 LomebuGame.exe 89 PID 4628 wrote to memory of 1344 4628 LomebuGame.exe 91 PID 4628 wrote to memory of 1344 4628 LomebuGame.exe 91 PID 4628 wrote to memory of 3992 4628 LomebuGame.exe 92 PID 4628 wrote to memory of 3992 4628 LomebuGame.exe 92 PID 4628 wrote to memory of 1692 4628 LomebuGame.exe 93 PID 4628 wrote to memory of 1692 4628 LomebuGame.exe 93 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 1228 4628 LomebuGame.exe 97 PID 4628 wrote to memory of 2700 4628 LomebuGame.exe 98 PID 4628 wrote to memory of 2700 4628 LomebuGame.exe 98 PID 4628 wrote to memory of 3740 4628 LomebuGame.exe 100 PID 4628 wrote to memory of 3740 4628 LomebuGame.exe 100 PID 3740 wrote to memory of 2476 3740 cmd.exe 102 PID 3740 wrote to memory of 2476 3740 cmd.exe 102 PID 4628 wrote to memory of 3724 4628 LomebuGame.exe 111 PID 4628 wrote to memory of 3724 4628 LomebuGame.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\system32\chcp.comchcp3⤵PID:4624
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵PID:4924
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\LomebuGame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 --field-trial-handle=1860,i,18271975307492710049,4216440686319860870,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1228
-
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\LomebuGame" --mojo-platform-channel-handle=2092 --field-trial-handle=1860,i,18271975307492710049,4216440686319860870,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵PID:2476
-
-
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\LomebuGame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 --field-trial-handle=1860,i,18271975307492710049,4216440686319860870,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3724
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD550c591ec2a1e49297738ea9f28e3ad23
SHA1137e36b4c7c40900138a6bcf8cf5a3cce4d142af
SHA2567648d785bda8cef95176c70711418cf3f18e065f7710f2ef467884b4887d8447
SHA51233b5fa32501855c2617a822a4e1a2c9b71f2cf27e1b896cf6e5a28473cfd5e6d126840ca1aa1f59ef32b0d0a82a2a95c94a9cc8b845367b61e65ec70d456deec
-
Filesize
2KB
MD52f87410b0d834a14ceff69e18946d066
SHA1f2ec80550202d493db61806693439a57b76634f3
SHA2565422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65
SHA512a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4
-
Filesize
131KB
MD54bcefe873798966491bc7cf2ee25d7bf
SHA1b3240ef4971cb2e2bdcdd06791fe528267035ee4
SHA256e96f77361e9c2443a70e7dd9ab62f4b6c9967f80115565f1c284342a78192df4
SHA5120e1cdb77848f56e75f2c932fbf3e28bc99e59c9f06b89be8848b95746291b6e539a6e0252345cf3172bd11893dd1806b58ce14cab6336ea533b0f4dba6d3ea06
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.8MB
MD584319927155ec1c7e297a00d8bf8ed11
SHA18fc08f22de1d85a499941d5a8ffdb86485439c23
SHA256fbbce4b12e31bd69e21bedcaef8ee9467b97117a335bd99cfa89cbdafdfd83ba
SHA512caf12012769e565653c2f216b77e34303d9943056e3895ce38baa869a1a72e0bb6872d8b40cde0b41dc673c40740355e52abdeaeb3da416ab8b94c1e534a5165