Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3LomebuGame.rar
windows7-x64
3LomebuGame.rar
windows10-2004-x64
3bomelugame...me.exe
windows7-x64
7bomelugame...me.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
7LICENSE.electron.txt
windows7-x64
1LICENSE.electron.txt
windows10-2004-x64
1LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1LomebuGame.exe
windows7-x64
1LomebuGame.exe
windows10-2004-x64
7chrome_100...nt.pak
windows7-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_200...nt.pak
windows7-x64
3chrome_200...nt.pak
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1icudtl.dat
windows7-x64
3icudtl.dat
windows10-2004-x64
3libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1Resubmissions
27/04/2024, 19:36
240427-ybnfasfc9t 727/04/2024, 19:12
240427-xwpy7afb2v 727/04/2024, 18:20
240427-wy4ppaed6x 7Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
LomebuGame.rar
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral2
Sample
LomebuGame.rar
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
bomelugame/LomebuGame.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
bomelugame/LomebuGame.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
LICENSE.electron.txt
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral16
Sample
LICENSE.electron.txt
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
LICENSES.chromium.html
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
LomebuGame.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral20
Sample
LomebuGame.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
chrome_100_percent.pak
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral22
Sample
chrome_100_percent.pak
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
chrome_200_percent.pak
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral24
Sample
chrome_200_percent.pak
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
ffmpeg.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral27
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
icudtl.dat
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral29
Sample
icudtl.dat
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
libEGL.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral31
Sample
libEGL.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
libGLESv2.dll
Resource
win7-20231129-en
windows7-x64
General
-
Target
LomebuGame.exe
-
Size
152.7MB
-
MD5
88719f2009bf17f5be9713212f520ab4
-
SHA1
0b843803935d15ff0179cbc83a66768eed88f381
-
SHA256
cde6587e39b95f9debf34ce7c2af0932c8711597fc81609f4d300e63b2fe39dd
-
SHA512
c1fa450234e5571d4c6cfa4a19e7ef5859bcf2300a25462e9eb16198618b9dfdcdb1f15fce309571de58c38c1107c26ad47a65d03eaf1e72ec538b0410784b0b
-
SSDEEP
1572864:gLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:gypCmJctBjj2+Jv
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 3712 LomebuGame.exe 3712 LomebuGame.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ipinfo.io -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3824 powershell.exe 3068 powershell.exe 3068 powershell.exe 684 LomebuGame.exe 684 LomebuGame.exe 3936 powershell.exe 3824 powershell.exe 3936 powershell.exe 1156 LomebuGame.exe 1156 LomebuGame.exe 1156 LomebuGame.exe 1156 LomebuGame.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3824 powershell.exe Token: SeDebugPrivilege 3068 powershell.exe Token: SeDebugPrivilege 3936 powershell.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeIncreaseQuotaPrivilege 3068 powershell.exe Token: SeSecurityPrivilege 3068 powershell.exe Token: SeTakeOwnershipPrivilege 3068 powershell.exe Token: SeLoadDriverPrivilege 3068 powershell.exe Token: SeSystemProfilePrivilege 3068 powershell.exe Token: SeSystemtimePrivilege 3068 powershell.exe Token: SeProfSingleProcessPrivilege 3068 powershell.exe Token: SeIncBasePriorityPrivilege 3068 powershell.exe Token: SeCreatePagefilePrivilege 3068 powershell.exe Token: SeBackupPrivilege 3068 powershell.exe Token: SeRestorePrivilege 3068 powershell.exe Token: SeShutdownPrivilege 3068 powershell.exe Token: SeDebugPrivilege 3068 powershell.exe Token: SeSystemEnvironmentPrivilege 3068 powershell.exe Token: SeRemoteShutdownPrivilege 3068 powershell.exe Token: SeUndockPrivilege 3068 powershell.exe Token: SeManageVolumePrivilege 3068 powershell.exe Token: 33 3068 powershell.exe Token: 34 3068 powershell.exe Token: 35 3068 powershell.exe Token: 36 3068 powershell.exe Token: SeIncreaseQuotaPrivilege 3936 powershell.exe Token: SeSecurityPrivilege 3936 powershell.exe Token: SeTakeOwnershipPrivilege 3936 powershell.exe Token: SeLoadDriverPrivilege 3936 powershell.exe Token: SeSystemProfilePrivilege 3936 powershell.exe Token: SeSystemtimePrivilege 3936 powershell.exe Token: SeProfSingleProcessPrivilege 3936 powershell.exe Token: SeIncBasePriorityPrivilege 3936 powershell.exe Token: SeCreatePagefilePrivilege 3936 powershell.exe Token: SeBackupPrivilege 3936 powershell.exe Token: SeRestorePrivilege 3936 powershell.exe Token: SeShutdownPrivilege 3936 powershell.exe Token: SeDebugPrivilege 3936 powershell.exe Token: SeSystemEnvironmentPrivilege 3936 powershell.exe Token: SeRemoteShutdownPrivilege 3936 powershell.exe Token: SeUndockPrivilege 3936 powershell.exe Token: SeManageVolumePrivilege 3936 powershell.exe Token: 33 3936 powershell.exe Token: 34 3936 powershell.exe Token: 35 3936 powershell.exe Token: 36 3936 powershell.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe Token: SeCreatePagefilePrivilege 3712 LomebuGame.exe Token: SeShutdownPrivilege 3712 LomebuGame.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 3712 wrote to memory of 4448 3712 LomebuGame.exe 84 PID 3712 wrote to memory of 4448 3712 LomebuGame.exe 84 PID 4448 wrote to memory of 1428 4448 cmd.exe 86 PID 4448 wrote to memory of 1428 4448 cmd.exe 86 PID 3712 wrote to memory of 2084 3712 LomebuGame.exe 87 PID 3712 wrote to memory of 2084 3712 LomebuGame.exe 87 PID 3712 wrote to memory of 3936 3712 LomebuGame.exe 89 PID 3712 wrote to memory of 3936 3712 LomebuGame.exe 89 PID 3712 wrote to memory of 3068 3712 LomebuGame.exe 90 PID 3712 wrote to memory of 3068 3712 LomebuGame.exe 90 PID 3712 wrote to memory of 3824 3712 LomebuGame.exe 91 PID 3712 wrote to memory of 3824 3712 LomebuGame.exe 91 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 1516 3712 LomebuGame.exe 95 PID 3712 wrote to memory of 684 3712 LomebuGame.exe 96 PID 3712 wrote to memory of 684 3712 LomebuGame.exe 96 PID 3712 wrote to memory of 264 3712 LomebuGame.exe 98 PID 3712 wrote to memory of 264 3712 LomebuGame.exe 98 PID 264 wrote to memory of 3500 264 cmd.exe 100 PID 264 wrote to memory of 3500 264 cmd.exe 100 PID 3712 wrote to memory of 1156 3712 LomebuGame.exe 109 PID 3712 wrote to memory of 1156 3712 LomebuGame.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp"2⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\system32\chcp.comchcp3⤵PID:1428
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "echo %COMPUTERNAME%.%USERDNSDOMAIN%"2⤵PID:2084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NoLogo -InputFormat Text -NoExit -ExecutionPolicy Unrestricted -Command -2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\LomebuGame" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 --field-trial-handle=1872,i,7840333458757522833,12925890125900579830,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\LomebuGame" --mojo-platform-channel-handle=2092 --field-trial-handle=1872,i,7840333458757522833,12925890125900579830,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "findstr /C:"Detected boot environment" "%windir%\Panther\setupact.log""2⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\system32\findstr.exefindstr /C:"Detected boot environment" "C:\Windows\Panther\setupact.log"3⤵PID:3500
-
-
-
C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe"C:\Users\Admin\AppData\Local\Temp\LomebuGame.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\LomebuGame" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2676 --field-trial-handle=1872,i,7840333458757522833,12925890125900579830,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1156
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD550c591ec2a1e49297738ea9f28e3ad23
SHA1137e36b4c7c40900138a6bcf8cf5a3cce4d142af
SHA2567648d785bda8cef95176c70711418cf3f18e065f7710f2ef467884b4887d8447
SHA51233b5fa32501855c2617a822a4e1a2c9b71f2cf27e1b896cf6e5a28473cfd5e6d126840ca1aa1f59ef32b0d0a82a2a95c94a9cc8b845367b61e65ec70d456deec
-
Filesize
2KB
MD52f87410b0d834a14ceff69e18946d066
SHA1f2ec80550202d493db61806693439a57b76634f3
SHA2565422bc17b852ad463110de0db9b59ffa4219e065d3e2843618d6ebbd14273c65
SHA512a313702f22450ceff0a1d7f890b0c16cf667dbcd668dbafa6dbecd0791236c0bc68e834d12113cc75352365c2a2b6cfcf30b6ef7c97ea53ed135da50de389db4
-
Filesize
1.8MB
MD584319927155ec1c7e297a00d8bf8ed11
SHA18fc08f22de1d85a499941d5a8ffdb86485439c23
SHA256fbbce4b12e31bd69e21bedcaef8ee9467b97117a335bd99cfa89cbdafdfd83ba
SHA512caf12012769e565653c2f216b77e34303d9943056e3895ce38baa869a1a72e0bb6872d8b40cde0b41dc673c40740355e52abdeaeb3da416ab8b94c1e534a5165
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
131KB
MD54bcefe873798966491bc7cf2ee25d7bf
SHA1b3240ef4971cb2e2bdcdd06791fe528267035ee4
SHA256e96f77361e9c2443a70e7dd9ab62f4b6c9967f80115565f1c284342a78192df4
SHA5120e1cdb77848f56e75f2c932fbf3e28bc99e59c9f06b89be8848b95746291b6e539a6e0252345cf3172bd11893dd1806b58ce14cab6336ea533b0f4dba6d3ea06