Overview
overview
7Static
static
3iLemon/lpk.dll
windows7-x64
7iLemon/lpk.dll
windows10-2004-x64
7iLemon/set...1].exe
windows7-x64
7iLemon/set...1].exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
31.3.1.1002...ar.exe
windows7-x64
61.3.1.1002...ar.exe
windows10-2004-x64
71.3.1.1002...ce.exe
windows7-x64
11.3.1.1002...ce.exe
windows10-2004-x64
11.3.1.1002...er.exe
windows7-x64
11.3.1.1002...er.exe
windows10-2004-x64
11.3.1.1002...64.exe
windows7-x64
11.3.1.1002...64.exe
windows10-2004-x64
11.3.1.1002...op.exe
windows7-x64
61.3.1.1002...op.exe
windows10-2004-x64
71.3.1.1002...te.exe
windows7-x64
11.3.1.1002...te.exe
windows10-2004-x64
1ShellExtHelper.dll
windows7-x64
7ShellExtHelper.dll
windows10-2004-x64
7ShellExtHelper64.dll
windows7-x64
7ShellExtHelper64.dll
windows10-2004-x64
7iLemon.exe
windows7-x64
6iLemon.exe
windows10-2004-x64
6Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 06:58
Static task
static1
Behavioral task
behavioral1
Sample
iLemon/lpk.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
iLemon/lpk.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
iLemon/setup_1.3.1.1002_qd[1].exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
iLemon/setup_1.3.1.1002_qd[1].exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
1.3.1.1002/LemonCalendar.exe
Resource
win7-20240611-en
Behavioral task
behavioral16
Sample
1.3.1.1002/LemonCalendar.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
1.3.1.1002/LemonService.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
1.3.1.1002/LemonService.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
1.3.1.1002/RunningHelper.exe
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
1.3.1.1002/RunningHelper.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral21
Sample
1.3.1.1002/RunningHelper64.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
1.3.1.1002/RunningHelper64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
1.3.1.1002/SmartDesktop.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
1.3.1.1002/SmartDesktop.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
1.3.1.1002/SmartNote.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
1.3.1.1002/SmartNote.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
ShellExtHelper.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
ShellExtHelper.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
ShellExtHelper64.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
ShellExtHelper64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
iLemon.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
iLemon.exe
Resource
win10v2004-20240611-en
General
-
Target
iLemon/lpk.dll
-
Size
46KB
-
MD5
d678a9bbbeeeacdafcc538171ab5dd8f
-
SHA1
fd511a172eb91d35dd71ba37cdfcc6870bb4df22
-
SHA256
1ca2927f7e0478c41f94823bb99b74928b36b618ac29a21aeeb95d632089e8d1
-
SHA512
eb60111a8d826f3e5aacdb6755de6e9dd952199419c62349f4ac22c896dcccfca8ca4fd3b923de431ce9b5ad1bb5de6e1a62fe71ee681ade6ab39089801f4ca2
-
SSDEEP
768:hojY9PKqxdonOp+IKDDCgEeJ9nmJKLVWrVzD5fc5yzOojY9Po:0myqx6nOp+I5kmJKRWbc5yzvmg
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
hrl73F8.tmpzqhjao.exepid process 2088 hrl73F8.tmp 3020 zqhjao.exe -
Loads dropped DLL 3 IoCs
Processes:
rundll32.exezqhjao.exepid process 2096 rundll32.exe 2096 rundll32.exe 3020 zqhjao.exe -
Drops file in System32 directory 3 IoCs
Processes:
hrl73F8.tmpzqhjao.exedescription ioc process File created C:\Windows\SysWOW64\zqhjao.exe hrl73F8.tmp File opened for modification C:\Windows\SysWOW64\zqhjao.exe hrl73F8.tmp File created C:\Windows\SysWOW64\hra33.dll zqhjao.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
hrl73F8.tmpzqhjao.exepid process 2088 hrl73F8.tmp 2088 hrl73F8.tmp 3020 zqhjao.exe 3020 zqhjao.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1052 wrote to memory of 2096 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 2096 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 2096 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 2096 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 2096 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 2096 1052 rundll32.exe rundll32.exe PID 1052 wrote to memory of 2096 1052 rundll32.exe rundll32.exe PID 2096 wrote to memory of 2088 2096 rundll32.exe hrl73F8.tmp PID 2096 wrote to memory of 2088 2096 rundll32.exe hrl73F8.tmp PID 2096 wrote to memory of 2088 2096 rundll32.exe hrl73F8.tmp PID 2096 wrote to memory of 2088 2096 rundll32.exe hrl73F8.tmp
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\iLemon\lpk.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\iLemon\lpk.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hrl73F8.tmpC:\Users\Admin\AppData\Local\Temp\hrl73F8.tmp3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\zqhjao.exeC:\Windows\SysWOW64\zqhjao.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\hrl73F8.tmpFilesize
38KB
MD59207aff9be07ce6a7c809fc935ac8f63
SHA13cac8e650e83f17eefe4098cdd8236c645e19368
SHA256a9dbc1a151bba11b32da044da91f019e9d8220065845e7ed402ad8181e58ce5c
SHA512570f0b92f30246dfeef48466f0ba23f546234aec8e579d4f6c34f483268ab849f7c7e9f2cb364243392b8fae298303a06bfddcf043fb11c1b1efb9f78d81e7ef
-
\Windows\SysWOW64\hra33.dllFilesize
7KB
MD57147ff24579a477a1a34696926e573f1
SHA19127ea8d813ecd5788b3f97777931ec79b7760e9
SHA256fd08dcb016611316c849d48312ba6dc7d4de75d1a81c1d475a13bb5a1ba07267
SHA512077b68376679c30d2dbae460ed59f5131c177bdd7574af1c2660ed97ae242b1401816d012af321c278be065b49bc9eab395e008b1b9a2447aa27b694bbed1d5d
-
memory/2088-11-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB